joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459470
Capabilities:
Check os version

Disassembly:
push esi
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jbe 0x4594b9
push 0x67ea50
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4594b2
push str.SetThreadUILanguage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4594ab
mov ecx, dword [esp + 0xc]
push ecx
call eax
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
ret 4
mov edx, dword [esp + 0xc]
and edx, 0xffff
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
pop edi
pop esi
ret 4

Function at 0x459c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61cc5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x67f740]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._08lX__04lX__04lX__02lX_02lX__02lX_02lX_02lX_02lX_02lX_02lX
push ecx
call fcn.005e6f56
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.005eefa2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.005ef235
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x45a020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
push esi
test edx, edx
je 0x45a0d5
mov esi, dword [esp + 0x10]
test esi, esi
je 0x45a0d5
mov eax, dword [esp + 8]
cmp esi, 4
push ebx
not eax
jb 0x45a0aa
push edi
mov edi, esi
shr edi, 2
mov ebx, dword [edx]
add edx, 4
xor eax, ebx
sub esi, 4
mov ecx, eax
mov ebx, eax
and ecx, 0xff
shr ebx, 8
mov eax, dword [ecx*4 + 0x638b4c]
xor eax, ebx
mov ecx, eax
and ecx, 0xff
shr eax, 8
mov ecx, dword [ecx*4 + 0x638b4c]
xor ecx, eax
mov eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x638b4c]
xor eax, ecx
mov ecx, eax
and ecx, 0xff
shr eax, 8
mov ecx, dword [ecx*4 + 0x638b4c]
xor eax, ecx
dec edi
jne 0x45a04b
pop edi
mov ecx, esi
dec esi
test ecx, ecx
je 0x45a0d0
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x638b4c]
xor eax, ecx
inc edx
dec esi
jne 0x45a0b2
pop ebx
pop esi
not eax
ret
mov eax, dword [esp + 8]
pop esi
ret
Function at 0x45bfd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push 0x679e38
push ecx
call fcn.0042c083
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x45c0aa
mov edi, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x45c090
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
lea ecx, [eax + eax]
push ecx
call fcn.005eef68
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x45c090
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ebx
push edi
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x45c0c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push 0x679e38
push ecx
call fcn.0042c083
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x45c159
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8
Function at 0x45c380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x45c41a
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x45c404
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.005eef68
mov esi, eax
add esp, 4
test esi, esi
je 0x45c404
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x45c5b0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61cf8b
push eax
mov dword fs:[0], esp
sub esp, 0x65c
mov ecx, 0x6a6608
push ebx
push ebp
push esi
push edi
push str.PATH
push 0x6a660c
call fcn.0045c380
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x45c601
push ebp
call fcn.0042be80
add esp, 4
test eax, eax
jne 0x45c644
push ebp
call fcn.005eef91
add esp, 4
push 0x6847ec
call fcn.0042be80
inc eax
lea esi, [eax + eax]
push esi
call fcn.005eef68
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x45c788
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x6847ec
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call fcn.0042be5b
add esp, 8
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x264]
push eax
push str.oadbg_
push str._s_s_
push ecx
call fcn.0042c083
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x476]
mov word [esp + 0x474], bx
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x264]
stosw word es:[edi], ax
push edx
push ebp
lea eax, [esp + 0x46c]
push 0x6847c0
push eax
call fcn.0042c083
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45c77f
mov esi, dword [esp + 0x680]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x40]
push 0x67ec9c
push eax
call edi
test eax, eax
je 0x45c768
lea ecx, [esp + 0x40]
push 0x67ec98
push ecx
call edi
test eax, eax
je 0x45c768
test byte [esp + 0x14], 0x10
jne 0x45c768
lea edx, [esp + 0x40]
lea ecx, [esp + 0x10]
push edx
call fcn.005ef2a9
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x67c], 0
call fcn.005ebcdb
lea ecx, [esp + 0x10]
mov dword [esp + 0x674], 0xffffffff
call fcn.005ef235
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45c704
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call fcn.005eef91
add esp, 4
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x668
ret 8
Function at 0x45d6c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x6a6a90]
sub esp, 0x114
test eax, eax
jne 0x45d80d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
push 0x6a6828
mov dword [0x6a6a90], 1
mov dword [0x6a6828], 0x114
call esi
mov edx, dword [0x6a6838]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x6848d8], eax
je 0x45d7e8
push ebx
push 0x6a6940
mov dword [0x6a6940], 0x11c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x67ea50
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x6a6a84], eax
call edi
mov dword [0x6a6a88], eax
mov eax, dword [0x6a6a84]
test eax, eax
push 0x6a6a60
je 0x45d764
call eax
jmp 0x45d76a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x6a6944]
cmp eax, 6
jae 0x45d782
cmp eax, 5
jne 0x45d796
cmp dword [0x6a6948], 2
jb 0x45d796
cmp word [0x6a6a60], 9
jne 0x45d796
mov dword [0x6a681c], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x45d7b4
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x6a6a8c], edx
jmp 0x45d7ba
mov edx, dword [0x6a6a8c]
test edx, edx
je 0x45d7e8
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x45d7e8
mov ecx, dword [esp + 0x14]
mov dword [0x6a6834], ecx
push 0x6a6830
push 0x6a682c
call fcn.0045dbb0
add esp, 8
call fcn.0045d820
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x45ea60
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638fc8
push 0x42fb9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x6a6a94]
xor ebx, ebx
cmp eax, ebx
jne 0x45ebc0
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45ebbb
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x679e38
lea edx, [ebp - 0x42c]
push edx
call fcn.0042c083
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.005eef68
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x45ebbb
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45ebb2
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push 0x685978
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45ebb2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x6a6a94], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x45ebb2
push esi
call fcn.005eef91
add esp, 4
mov eax, dword [0x6a6a94]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45f380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x45f3c1
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x45f3c3
mov esi, edi
test esi, esi
je 0x45f438
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x45f42d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x45f42d
cmp dword [esp + 0x1c], eax
jbe 0x45f3fe
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x45f42d
cmp esi, edi
je 0x45f41f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x45f438
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x45f590
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x45f5ef
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x45f5ef
cmp dword [esp + 0xc], 3
jne 0x45f5ef
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x45f5ef
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x45f5ef
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc

Function at 0x45f6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x45f744
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x45f744
cmp dword [esp + 0x10], 3
jne 0x45f744
mov edx, dword [esp + 0x18]
push edx
call fcn.005eef68
mov edi, eax
add esp, 4
test edi, edi
je 0x45f744
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x45f73b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.005eef91
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x45f750
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x61d16f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x67f740]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x45f7bb
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x45f7bd
mov esi, edi
test esi, esi
je 0x45f887
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45f87c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x45f7ff
cmp eax, 2
je 0x45f7ff
cmp eax, 6
je 0x45f7ff
cmp eax, 7
jne 0x45f87c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.005eef68
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x45f862
lea ecx, [esp + 0x14]
call fcn.005ef3cc
cmp esi, dword [esp + 0x14]
je 0x45f857
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.005eef91
add esp, 4
jmp 0x45f899
call fcn.005eef91
add esp, 4
lea ecx, [esp + 0x10]
push 0x69cacc
call fcn.005ef3cc
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x45f887
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x45f899
push eax
lea ecx, [esp + 0x14]
call fcn.005ef3cc
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.005eefa2
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.005ef235
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x45f9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x45fa17
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x45fa1a
mov esi, dword [ebp + 8]
test esi, esi
je 0x45fbcd
call fcn.0045ddb0
test eax, eax
je 0x45fac5
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45fbc1
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x45fa69
cmp eax, 2
je 0x45fa69
cmp eax, 6
je 0x45fa69
cmp eax, 7
jne 0x45fbc1
mov ecx, dword [ebp + 0xc]
add ecx, 2
push ecx
call fcn.005eef68
mov edx, dword [ebp + 0xc]
mov ebx, eax
xor eax, eax
mov edi, ebx
lea ecx, [edx + 2]
add esp, 4
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x45fbac
mov ecx, dword [ebp + 0x18]
call fcn.00446360
cmp esi, dword [ebp + 8]
je 0x45fb96
jmp 0x45fb8f
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x45fad1
mov dword [ebp + 0x10], eax
jmp 0x45fb06
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.0042ccd0
mov edx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0x10], edi
mov edx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 0x14]
push 0
push ecx
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45fbc1
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x45fb40
cmp eax, 2
je 0x45fb40
cmp eax, 6
je 0x45fb40
cmp eax, 7
jne 0x45fbc1
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
call fcn.005eef68
mov ecx, dword [ebp + 0xc]
mov ebx, eax
add ecx, 2
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x45fbac
mov ecx, dword [ebp + 0x18]
call fcn.00446430
cmp esi, dword [ebp + 8]
je 0x45fb96
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.005eef91
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.005eef91
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x69cacc
call fcn.00446360
cmp esi, dword [ebp + 8]
je 0x45fbcd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x460570
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x4605a9
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.0042be80
mov ecx, dword [esp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
jne 0x4605a9
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x4605e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61d238
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x460636
lea ecx, [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0xc]
or ecx, 0x20006
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x46063b
mov esi, dword [ebp + 8]
mov ebx, esi
test esi, esi
je 0x46072a
call fcn.0045ddb0
test eax, eax
je 0x46068a
mov edi, dword [ebp + 0x18]
push edi
call fcn.0042be80
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x10]
push edx
push edi
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x46071f
cmp esi, ebx
je 0x460680
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x46072c
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x460695
xor edi, edi
jmp 0x4606ca
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.0042ccd0
mov ecx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push edx
call fcn.004400e0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x460710
cmp esi, ebx
je 0x4606fa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004408f0
mov eax, 1
jmp 0x46072c
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004408f0
cmp esi, ebx
je 0x46072a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret