joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4567cc
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x6c8370]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov edi, ecx
mov dword [ebp - 0x238], 0x22c
push 2
mov dword [ebp - 0x23c], edi
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
jmp 0x456896
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.00504547
pop ecx
pop ecx
test eax, eax
jne 0x456888
push dword [ebp - 0x230]
push eax
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
je 0x456856
push 0x1388
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x45687b
push dword [ebp - 0x23c]
push str.TerminateProcess_failed_for_process_with_name__s
push 0
push 0
call fcn.0043ceb9
push str.Please_terminate_this_process_manually
push 0
push 0
call fcn.0043ceb9
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x456812
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004da18b
mov esp, ebp
pop ebp
ret
Function at 0x4568b5
Capabilities:
Write file on windows

Disassembly:
push 0x23c
mov eax, 0x527338
call fcn.004dacdd
mov edi, edx
mov dword [ebp - 0x23c], edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
movzx ecx, cx
push eax
mov dword [ebp - 0x248], esi
call fcn.00458c94
pop ecx
pop ecx
test al, al
jne 0x456910
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.ExtractExecutable___GetResourceBytes_failed___d_
xor ebx, ebx
push ebx
push ebx
call fcn.0043ceb9
add esp, 0x10
xor al, al
jmp 0x456aab
xor ebx, ebx
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
call fcn.00456c20
test al, al
jne 0x45694e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.ExtractExecutable___GetTempPath_failed___d_
jmp 0x456a87
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x456986
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.ExtractExecutable___PathCombine_failed___d_
jmp 0x456a87
mov byte [ebp - 0x231], bl
jmp 0x4569c6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp byte [ebp - 0x231], 0
jne 0x456a63
cmp eax, 0x20
jne 0x456a63
cmp byte [ebp + 0xc], 0
jne 0x456a52
mov ecx, dword [ebp - 0x23c]
call fcn.004567cc
mov byte [ebp - 0x231], 1
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45698e
mov esi, dword [ebp - 0x240]
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
push dword [ebp - 0x244]
mov dword [ebp - 0x238], ebx
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x456a6b
cmp dword [ebp - 0x238], esi
jne 0x456a6b
push edi
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
test eax, eax
je 0x456a6b
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x218]
push eax
call fcn.004293bf
pop ecx
mov ecx, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00429346
mov byte [ebp - 0x231], 1
jmp 0x456a97
lea eax, [ebp - 0x218]
push eax
call fcn.004293bf
pop ecx
mov ecx, esi
jmp 0x456a3c
push eax
push str.ExtractExecutable___CreateFile_failed___d_
jmp 0x456a87
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
push str.ExtractExecutable___WriteFile_FlushFileBuffers_failed___d_
push ebx
push ebx
call fcn.0043ceb9
add esp, 0x10
mov byte [ebp - 0x231], bl
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.0042ab9c
mov al, byte [ebp - 0x231]
call fcn.004dac87
ret
Function at 0x456ab1
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x25c
mov eax, 0x527381
call fcn.004dacdd
mov dword [ebp - 0x268], edx
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x21c]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x456b01
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.GetDataPath
push str._s___SHGetFolderPath_failed___d_
push ebx
push ebx
call fcn.0043ceb9
add esp, 0x14
xor al, al
jmp 0x456bf1
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.0042efc6
lea eax, [ebp - 0x264]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x234]
call fcn.00429503
mov byte [ebp - 4], 1
mov esi, dword [edi]
mov edi, dword [edi + 4]
cmp esi, edi
je 0x456ba3
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
lea ecx, [ebp - 0x24c]
call fcn.00429503
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x234]
call fcn.0042f5e6
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push 0
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x456b87
call ebx
cmp eax, 0xb7
jne 0x456bf7
push 0
push 1
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 1
call fcn.0042ab9c
add esi, 0x18
cmp esi, edi
jne 0x456b3b
xor ebx, ebx
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00423c9c
mov ecx, dword [ebp - 0x268]
push eax
call fcn.0042ab1f
push ebx
push 1
lea ecx, [ebp - 0x24c]
call fcn.0042ab9c
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x234]
call fcn.0042ab9c
push 0
push 1
lea ecx, [ebp - 0x264]
call fcn.0042ab9c
mov al, bl
call fcn.004dac87
ret
call ebx
push eax
push str.GetDataPath
push str._s___create_directory_failed___d_
xor ebx, ebx
push ebx
push ebx
call fcn.0043ceb9
add esp, 0x14
lea ecx, [ebp - 0x24c]
push ebx
push 1
call fcn.0042ab9c
jmp 0x456bd1

Function at 0x456c20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6c8370]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
and dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x456c44
mov eax, dword [esi]
jmp 0x456c46
mov eax, esi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
cmp eax, 0xf6
ja 0x456c88
test eax, eax
je 0x456c88
lea eax, [ebp - 0x20c]
push eax
call fcn.004293bf
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00429346
mov al, 1
jmp 0x456c8a
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004da18b
mov esp, ebp
pop ebp
ret
Function at 0x456ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x14], 8
push ebx
push esi
push edi
mov edi, edx
jb 0x456ee1
mov ecx, dword [ecx]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x456f32
cmp dword [edi + 0x14], 0x10
lea ebx, [edi + 0x10]
jb 0x456f0c
mov edi, dword [edi]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebx]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x456f32
mov eax, dword [ebp - 4]
cmp eax, dword [ebx]
jne 0x456f32
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x456f66
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x456f4d
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edi
push 0x6a1bdc
push str._s___write_file_failed___d_
push 0
push 0
call fcn.0043ceb9
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456f6d
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov eax, dword [0x6c8370]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 0x1e0], eax
push edi
test si, si
je 0x457110
lea eax, [ebp - 0x1d0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 2
pop eax
push str.127.0.0.1
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
or edi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x1d4], eax
call esi
mov dword [ebp - 0x1d8], eax
call esi
mov ecx, dword [ebp - 0x1d8]
cmp eax, ecx
jb 0x4570ee
add ecx, ebx
mov ebx, dword [ebp - 0x1d8]
mov dword [ebp - 0x1e4], ecx
xor esi, esi
cmp eax, ecx
jae 0x4570ee
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x45709d
push 0x10
push dword [ebp - 0x1d4]
push edi
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
test eax, eax
jne 0x45709d
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x45709d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x45709d
push esi
push 0x64
push 1
lea eax, [ebp - 0x1d4]
push eax
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
test eax, eax
jne 0x45709d
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x1d4]
push edi
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
test eax, eax
jne 0x45709d
test byte [ebp - 0x40], 0x10
je 0x45709d
cmp dword [ebp - 0x2c], esi
je 0x4570f3
mov eax, dword [ebp - 0x1dc]
test eax, eax
je 0x4570b3
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x4570e0
mov edx, dword [ebp - 0x1e0]
mov ecx, dword [edx]
test ecx, ecx
je 0x4570cb
mov eax, dword [ecx]
push esi
push dword [edx + 4]
call dword [eax]
test eax, eax
jne 0x4570e7
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, ebx
jb 0x4570ee
mov ecx, dword [ebp - 0x1e4]
jmp 0x457011
mov esi, 0x24f
jmp 0x4570f3
mov esi, 0x3e3
jmp 0x4570f3
mov esi, 0x102
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebp - 0x1d4]
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
jmp 0x457115
mov eax, 0x704
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004da18b
mov esp, ebp
pop ebp
ret
Function at 0x457177
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.KERNEL32.DLL_AttachConsole]
test eax, eax
je 0x4571a4
push esi
push 1
call dword [sym.imp.KERNEL32.DLL_GenerateConsoleCtrlEvent]
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
push 0x64
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x4571d3
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
je 0x4571c1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x4571d3
push esi
push str.TerminateProcess_failed_for_process_with_PID__d
push 0
push 0
call fcn.0043ceb9
add esp, 0x10
pop edi
pop esi
ret
Function at 0x4575a0
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x5273fc
call fcn.004daca9
mov dword [ebp - 0x18], edx
mov esi, ecx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x457601
cmp dword [esi + 0x14], 0x10
jb 0x4575e6
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryDwordValue
push str._s:_RegCreateKeyEx_failed_for__hs_with_code__ld
push 1
push ebx
call fcn.0043ceb9
add esp, 0x18
xor al, al
jmp 0x457672
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.00423884
add esp, 4
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 0x10
jb 0x45761c
mov eax, dword [esi]
jmp 0x45761e
mov eax, esi
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x457656
cmp dword [esi + 0x14], 0x10
jb 0x45763d
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryDwordValue
push str._s:_RegSetValueExA_failed_for__hs_with_code__ld
push 1
push ebx
call fcn.0043ceb9
add esp, 0x18
jmp 0x457658
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov al, bl
call fcn.004dac72
ret
Function at 0x457678
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x5273fc
call fcn.004daca9
mov edi, edx
mov esi, ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4576d8
cmp dword [esi + 0x14], 0x10
jb 0x4576ba
mov esi, dword [esi]
push eax
push esi
push str.ReadRegistryDwordValue
push str._s:_RegOpenKeyEx_failed_for__hs_with_code__ld
push 1
push ebx
call fcn.0043ceb9
add esp, 0x18
xor al, al
jmp 0x457768
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.00423884
add esp, 4
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 0x10
jb 0x4576f3
mov eax, dword [esi]
jmp 0x4576f5
mov eax, esi
lea ecx, [ebp - 0x18]
push ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x457723
cmp dword [esi + 0x14], 0x10
jb 0x457715
mov esi, dword [esi]
push eax
push esi
push str.ReadRegistryDwordValue
push str._s:_RegQueryValueExA_failed_for__hs_with_code__ld
jmp 0x45773f
cmp dword [ebp - 0x14], 4
je 0x45774c
cmp dword [esi + 0x14], 0x10
jb 0x457731
mov esi, dword [esi]
push dword [ebp - 0x14]
push esi
push str.ReadRegistryDwordValue
push str._s:_RegQueryValueExA_says_type_of__hs_is__ld__not_REG_DWORD
push 1
push ebx
call fcn.0043ceb9
add esp, 0x18
jmp 0x45774e
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov al, bl
call fcn.004dac72
ret
Function at 0x45776e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x52741f
call fcn.004daca9
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], ebx
mov dword [eax], ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4577d0
cmp dword [esi + 0x14], 0x10
jb 0x4577b2
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryStringValue
push str._s:_RegCreateKeyEx_failed_for__hs_with_code__ld
push 1
push ebx
call fcn.0043ceb9
add esp, 0x18
xor al, al
jmp 0x45785a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.00423884
add esp, 4
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x4577ec
mov edi, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x4577f6
mov ecx, dword [esi]
jmp 0x4577f8
mov ecx, esi
inc eax
push eax
push edi
push 1
push ebx
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
je 0x45783e
cmp dword [esi + 0x14], 0x10
jb 0x457816
mov esi, dword [esi]
push edi
push esi
push str.WriteRegistryStringValue
xor esi, esi
push str._s:_RegSetValueExA_failed_for__hs_with_code__ld
inc esi
push esi
push ebx
call fcn.0043ceb9
add esp, 0x18
cmp edi, 0x5aa
jne 0x457840
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x457840
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov al, bl
call fcn.004dac72
ret
Function at 0x457860
Capabilities:
Set registry value

Disassembly:
push 0x30
mov eax, 0x52744a
call fcn.004dacdd
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x38], eax
mov edx, esi
mov dword [ebp - 0x34], ebx
mov dword [eax], ebx
call fcn.00428a40
push ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4578d7
cmp dword [esi + 0x14], 0x10
jb 0x4578b4
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryStringValue
xor ebx, ebx
push str._s:_RegCreateKeyEx_failed_for__hs_with_code__ld
inc ebx
push ebx
push 0
call fcn.0043ceb9
add esp, 0x18
mov byte [ebp - 0x2d], 0
jmp 0x45796a
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3c]
call fcn.00423884
add esp, 4
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x4578f6
mov edi, dword [edi]
cmp dword [ebp - 0x18], 8
lea eax, [eax*2 + 2]
push eax
push edi
push ebx
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
push 0
push ecx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x45794f
cmp dword [esi + 0x14], 0x10
jb 0x457925
mov esi, dword [esi]
push edi
push esi
push str.WriteRegistryStringValue
push str._s:_RegSetValueExW_failed_for__hs_with_code__ld
push ebx
push 0
call fcn.0043ceb9
add esp, 0x18
cmp edi, 0x5aa
jne 0x457949
mov eax, dword [ebp - 0x38]
mov dword [eax], ebx
mov byte [ebp - 0x2d], 0
jmp 0x457952
mov byte [ebp - 0x2d], bl
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x3c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0042ab9c
mov al, byte [ebp - 0x2d]
call fcn.004dac87
ret
Function at 0x45797e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x5273fc
call fcn.004daca9
mov esi, edx
mov edi, ecx
xor ebx, ebx
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x45799d
mov eax, dword [esi]
jmp 0x45799f
mov eax, esi
mov byte [eax], bl
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4579e0
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegOpenKeyEx_failed_for__hs_with_code__ld
push 1
push ebx
call fcn.0043ceb9
add esp, 0x18
xor al, al
jmp 0x457a93
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.00423884
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x457a17
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExA_1__failed_for__hs_with_code__ld
jmp 0x457a6a
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x457a28
push ebx
dec eax
mov ecx, esi
push eax
call fcn.0041a47d
cmp dword [esi + 0x14], 0x10
jb 0x457a30
mov esi, dword [esi]
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x457a56
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExA_2__failed_for__hs_with_code__ld
jmp 0x457a6a
cmp dword [ebp - 0x18], 1
je 0x457a77
push dword [ebp - 0x18]
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExA_says_type_of__hs_is__ld__not_REG_SZ
push 1
push ebx
call fcn.0043ceb9
add esp, 0x18
jmp 0x457a79
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov al, bl
call fcn.004dac72
ret
Function at 0x457a99
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x34
mov eax, 0x52747f
call fcn.004dacdd
mov esi, edx
mov edi, ecx
xor ebx, ebx
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x457ab8
mov eax, dword [esi]
jmp 0x457aba
mov eax, esi
xor ecx, ecx
mov edx, edi
mov word [eax], cx
lea ecx, [ebp - 0x2c]
call fcn.0042a382
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
mov dword [ebp - 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x457b10
push eax
push edi
push str.ReadRegistryStringValue
xor ebx, ebx
push str._s:_RegOpenKeyEx_failed_for__hs_with_code__ld
inc ebx
push ebx
push 0
call fcn.0043ceb9
add esp, 0x18
mov byte [ebp - 0x2d], 0
jmp 0x457bf6
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40]
call fcn.00423884
add esp, 4
xor edx, edx
lea ecx, [ebp - 0x38]
push ecx
xor ebx, ebx
lea eax, [ebp - 0x2c]
push edx
inc ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 8
push edx
cmovae eax, dword [ebp - 0x2c]
push edx
push eax
push dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x457b57
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExW_1__failed_for__hs_with_code__ld
jmp 0x457bca
mov eax, dword [ebp - 0x38]
test al, 1
je 0x457b6c
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExW_1__for__hs_says_bufferLength_is_not_a_multiple_of_sizeof_wchar_t_:__ld
jmp 0x457bca
test eax, eax
je 0x457b7d
shr eax, 1
mov ecx, esi
push 0
dec eax
push eax
call fcn.004360f8
cmp dword [esi + 0x14], 8
jb 0x457b85
mov esi, dword [esi]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x38]
push ecx
push esi
lea ecx, [ebp - 0x3c]
push ecx
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x457bb7
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExW_2__failed_for__hs_with_code__ld
jmp 0x457bca
cmp dword [ebp - 0x3c], ebx
je 0x457bdb
push dword [ebp - 0x3c]
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExW_says_type_of__hs_is__ld__not_REG_SZ
push ebx
push 0
call fcn.0043ceb9
add esp, 0x18
mov byte [ebp - 0x2d], 0
jmp 0x457bde
mov byte [ebp - 0x2d], bl
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x40]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0042ab9c
mov al, byte [ebp - 0x2d]
call fcn.004dac87
ret