joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64b7e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, edx
mov edx, dword [esp + 8]
sub esp, 0x58
cmp edx, 0x10
jge 0x64b7f7
or eax, 0xffffffff
add esp, 0x58
ret 8
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov edx, ecx
push eax
lea ecx, [esp + 4]
mov dword [esp + 4], 0x67452301
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 0x10], 0x10325476
call fcn.0064b630
mov ecx, dword [esp + 0x5c]
lea edx, [esp]
call fcn.0064b6f0
xor eax, eax
add esp, 0x58
ret 8
Function at 0x653460
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
test ecx, ecx
mov dword [esp + 0x14], edx
je 0x653589
test edx, edx
je 0x653589
cmp dword [esp + 0x2c], 0x27
jl 0x653589
mov edx, 0x6f1c08
sub edx, ecx
mov dword [esp], edx
mov edx, 0x6f1bf8
sub edx, ecx
mov dword [esp + 4], edx
mov edx, 0x6f1c19
sub edx, ecx
xor eax, eax
mov dword [esp + 8], edx
push ebx
mov dword [esp + 0x1c], eax
mov edx, 0x6f1c09
sub edx, ecx
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], edx
push esi
mov dword [esp + 0x2c], eax
mov edx, 0x6f1bf9
mov ebp, ecx
mov ebx, 0x6f1c18
sub edx, ecx
mov esi, 0xfffffffe
push edi
mov dword [esp + 0x34], eax
sub ebp, 0x6f1c18
sub ebx, ecx
lea eax, [ecx + 2]
lea edi, [esp + 0x36]
mov dword [esp + 0x20], edx
sub esi, ecx
jmp 0x6534f0
lea ecx, [esi + eax + 0x6f1c18]
mov dl, byte [ecx + ebp]
add dl, byte [ecx]
xor dl, byte [esi + eax + 0x6f1c08]
sub dl, byte [esi + eax + 0x6f1bf8]
mov cl, byte [esi + eax + 0x6f1c19]
mov byte [edi + 1], dl
add cl, byte [eax - 1]
xor cl, byte [esi + eax + 0x6f1c09]
sub cl, byte [esi + eax + 0x6f1bf9]
mov dl, byte [ebx + eax]
mov byte [edi], cl
add dl, byte [eax]
mov ecx, dword [esp + 0x10]
xor dl, byte [ecx + eax]
mov ecx, dword [esp + 0x14]
sub dl, byte [ecx + eax]
add eax, 4
mov byte [edi - 1], dl
mov edx, dword [esp + 0x18]
mov cl, byte [edx + eax - 4]
mov dl, byte [eax - 3]
add cl, dl
mov edx, dword [esp + 0x1c]
xor cl, byte [edx + eax - 4]
mov edx, dword [esp + 0x20]
sub cl, byte [edx + eax - 4]
sub edi, 4
mov byte [edi + 2], cl
lea ecx, [esi + eax]
cmp ecx, 0x10
jl 0x6534f0
mov edx, dword [esp + 0x3c]
push 1
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
call fcn.0065ed90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov eax, 0x325
add esp, 0x28
ret 4
Function at 0x653fc0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x28
push esi
push edi
mov edi, ecx
test edi, edi
mov esi, edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
je 0x654114
test esi, esi
je 0x654114
mov eax, dword [esp + 0x34]
test eax, eax
je 0x654114
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x654000
sub eax, edx
cmp eax, 1
jb 0x654114
push 1
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x654040
push 0
push 0
push 1
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x65404d
pop edi
mov eax, 0x382
pop esi
add esp, 0x28
ret 8
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], eax
call fcn.00653e70
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x654102
mov eax, dword [esp + 8]
test eax, eax
je 0x654107
mov ecx, dword [esp + 0x14]
push ecx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x6540d8
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
mov eax, 0x35d
pop esi
add esp, 0x28
ret 8
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
mov eax, dword [esp + 0x38]
test eax, eax
je 0x6540f8
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp ecx, 1
sete dl
mov dword [eax], edx
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret 8
cmp eax, 5
je 0x6540cb
pop edi
mov eax, 0x35f
pop esi
add esp, 0x28
ret 8
pop edi
mov eax, 0x325
pop esi
add esp, 0x28
ret 8
Function at 0x6548d0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x12c
push ebx
mov ebx, ecx
test ebx, ebx
push esi
mov esi, edx
je 0x65494e
test esi, esi
je 0x65494e
push edi
mov edx, 0x64
lea ecx, [esp + 0x70]
call fcn.00650e80
mov edx, 0x64
lea ecx, [esp + 0xc]
call fcn.00651380
mov edx, 0x64
lea ecx, [esp + 0xd4]
call fcn.00650f50
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [esp + 0x70]
push eax
push esi
call edi
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
lea edx, [esp + 0xd4]
push edx
push esi
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push closesocket
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x12c
ret
pop esi
mov eax, 0x325
pop ebx
add esp, 0x12c
ret

Function at 0x654960
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x200
push esi
push edi
xor edi, edi
cmp ecx, edi
mov esi, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
je 0x654a9a
cmp esi, edi
je 0x654a9a
push ebx
push ebp
mov edx, 0x64
lea ecx, [esp + 0x80]
call fcn.00651430
mov edx, 0x64
lea ecx, [esp + 0x1c]
call fcn.006514a0
mov edx, 0x64
lea ecx, [esp + 0xe4]
call fcn.006514e0
mov edx, 0x64
lea ecx, [esp + 0x148]
call fcn.00651580
mov edx, 0x64
lea ecx, [esp + 0x1ac]
call fcn.00651620
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x2001f
push edi
lea ecx, [esp + 0x8c]
push ecx
push esi
call ebx
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x654a73
mov eax, dword [esp + 0x10]
test eax, eax
je 0x654a73
lea edx, [esp + 0x14]
push edx
push 0x2001f
push 0
lea ecx, [esp + 0x28]
push ecx
push eax
call ebx
test eax, eax
jne 0x654a42
mov eax, dword [esp + 0x14]
test eax, eax
je 0x654a42
lea edx, [esp + 0xe4]
push edx
push eax
call edi
mov eax, dword [esp + 0x14]
push eax
call ebp
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
call edi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x148]
push eax
push ecx
call edi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1ac]
push edx
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x80]
push edx
push esi
call edi
push esi
call ebp
mov eax, dword [esp + 0x18]
push eax
push closesocket
call edi
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x200
ret
pop edi
mov eax, 0x325
pop esi
add esp, 0x200
ret
Function at 0x6551d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e4
push ebp
push esi
push edi
mov ebp, edx
mov esi, ecx
test esi, esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
je 0x6553a6
test ebp, ebp
je 0x6553a6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x655210
sub eax, edx
cmp eax, 0x26
jne 0x6553a6
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x655227
sub eax, edx
cmp eax, 0x26
jne 0x6553a6
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x1f8]
rep stosd dword es:[edi], eax
mov ecx, 0x5a
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, 0x64
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x1f4
stosb byte es:[edi], al
call fcn.00650e80
mov ecx, esi
call fcn.00655090
cmp eax, 1
jne 0x6553a6
mov ecx, ebp
call fcn.00655130
cmp eax, 1
jne 0x6553a6
push 0x16b
lea edx, [esp + 0x8c]
mov ecx, esi
call fcn.006535a0
test eax, eax
jne 0x6553a6
call fcn.00653e70
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x94]
push ecx
push closesocket
call esi
test eax, eax
jne 0x6553a6
mov eax, dword [esp + 0x10]
test eax, eax
je 0x6553a6
call fcn.00653e70
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
call esi
test eax, eax
jne 0x65539b
mov eax, dword [esp + 0x14]
test eax, eax
je 0x65539b
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x1fc]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0x6b93e6
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x65537e
cmp dword [esp + 0x1c], 1
jne 0x65537e
cmp dword [esp + 0x18], 0x27
jne 0x65537e
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
call fcn.00653e70
lea edx, [esp + 0x1f8]
push ebp
push edx
call fcn.006968ed
add esp, 8
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
xor eax, eax
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
Function at 0x655670
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x68
push esi
push edi
mov edi, ecx
test edi, edi
mov esi, edx
mov dword [esp + 8], 0
je 0x6556fc
test esi, esi
jl 0x6556fc
jne 0x655693
pop edi
xor eax, eax
pop esi
add esp, 0x68
ret
mov edx, 0x64
lea ecx, [esp + 0xc]
call fcn.00651990
push 0xf0000000
push 1
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp eax, 1
jne 0x6556f1
mov eax, dword [esp + 8]
test eax, eax
je 0x6556f1
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edx, dword [esp + 8]
push 0
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, 0x382
pop esi
add esp, 0x68
ret
pop edi
mov eax, 0x382
pop esi
add esp, 0x68
ret
pop edi
mov eax, 0x325
pop esi
add esp, 0x68
ret

Function at 0x656250
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov edx, ecx
cmp edx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x104
je 0x6563a2
cmp edi, ebx
je 0x6563a2
mov ecx, dword [ebp + 8]
cmp ecx, 0xa
jl 0x6563a2
mov esi, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x656394
mov eax, dword [esp + 0x10]
test eax, eax
je 0x656394
lea esp, [esp]
cmp ebx, 0xff
jae 0x65637e
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push eax
push ebx
push ecx
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc ebx
cmp eax, 0x103
je 0x65637e
test eax, eax
jne 0x6562d0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x6562d0
cmp eax, 0x106
jb 0x656337
mov dword [esp + 0xc], 0x105
lea edx, [esp + 0xc]
lea ecx, [esp + 0x20]
call fcn.006561b0
mov edi, dword [esp + 0xc]
test edi, edi
jbe 0x6562d0
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
jle 0x6562d0
mov eax, dword [esp + 0x14]
lea esi, [esp + 0x20]
sub esi, eax
cmp ecx, edi
jge 0x6562d0
mov dl, byte [esi + eax]
add byte [eax], dl
mov edx, dword [ebp + 8]
inc ecx
inc eax
cmp ecx, edx
jl 0x656363
jmp 0x6562d0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x338
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6567d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x104
jne 0x656805
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.0064fcc0
cmp esi, 0xff
jae 0x6568fd
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x6568fd
test eax, eax
jne 0x656813
mov eax, dword [esp + 0xc]
test eax, eax
je 0x656813
cmp eax, 0x106
jb 0x656880
mov dword [esp + 0xc], 0x105
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x656887
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.00697b57
add esp, 0xc
test eax, eax
jne 0x656813
lea edx, [esp + 0x10]
push edx
push 0x20019
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x94]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x656813
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x656813
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.006564e0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x656813
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x656910
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x104
jne 0x656945
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.0064fbd0
cmp esi, 0xff
jae 0x656a3d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x656a3d
test eax, eax
jne 0x656953
mov eax, dword [esp + 0xc]
test eax, eax
je 0x656953
cmp eax, 0x106
jb 0x6569c0
mov dword [esp + 0xc], 0x105
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6569c7
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.00697b57
add esp, 0xc
test eax, eax
jne 0x656953
lea edx, [esp + 0x10]
push edx
push 0x20019
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x94]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x656953
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x656953
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.006567d0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x656953
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6570b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38c
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x104
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
je 0x6572a2
cmp edx, ebx
je 0x6572a2
cmp dword [ebp + 8], 0xa
jl 0x6572a2
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.006505f0
jmp 0x657110
cmp ebx, 0xff
jae 0x657297
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xac]
push edx
push ebx
push eax
mov dword [esp + 0x38], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
inc ebx
cmp esi, 0x103
je 0x657297
test esi, esi
jne 0x65728b
mov eax, dword [esp + 0x18]
test eax, eax
je 0x657110
movsx ecx, byte [esp + 0x98]
push ecx
call fcn.006978f7
add esp, 4
test eax, eax
je 0x657110
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 0x20019
push esi
lea eax, [esp + 0xa4]
push eax
push ecx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x657110
mov edx, dword [esp + 0x14]
test edx, edx
je 0x657110
mov ecx, 0x7d
lea edi, [esp + 0x1a0]
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1a4]
push ecx
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x40]
push ecx
push edx
mov dword [esp + 0x28], 0x1f3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x65728b
cmp dword [esp + 0x1c], 1
jne 0x657110
mov eax, dword [esp + 0x10]
test eax, eax
je 0x657110
cmp eax, 0x1f4
jb 0x657234
mov dword [esp + 0x10], 0x1f3
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1a0]
call fcn.006561b0
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x657110
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
jle 0x657110
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x1a0]
sub esi, eax
lea ebx, [ebx]
cmp ecx, edi
jge 0x657110
mov dl, byte [esi + eax]
add byte [eax], dl
mov edx, dword [ebp + 8]
inc ecx
inc eax
cmp ecx, edx
jl 0x657270
jmp 0x657110
cmp esi, 0x103
jne 0x657110
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6572b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x104
jne 0x6572e9
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.00650300
jmp 0x657300
cmp esi, 0xff
jae 0x65740c
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xa4]
push edx
push esi
push ebx
mov dword [esp + 0x38], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x65740c
test eax, eax
jne 0x657300
mov eax, dword [esp + 0x18]
test eax, eax
je 0x657300
movsx eax, byte [esp + 0x90]
push eax
call fcn.006978f7
add esp, 4
test eax, eax
je 0x657300
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x9c]
push edx
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x657300
mov eax, dword [esp + 0x10]
test eax, eax
je 0x657300
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6573fc
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x6573fc
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x1c]
push eax
call fcn.006570b0
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
jmp 0x657300
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x657300
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x657dd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
cmp esi, ebx
mov ebp, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
je 0x657fdb
cmp ebp, 0xa
jl 0x657fdb
push edi
mov ecx, ebp
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00655400
cmp eax, 1
lea ecx, [esp + 0x94]
mov edx, 0x64
jne 0x657e3e
call fcn.0064b9a0
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.0064c7d0
jmp 0x657e62
call fcn.0064bd90
mov edx, 0x64
lea ecx, [esp + 0x30]
call fcn.0064c5f0
mov edx, 0x64
lea ecx, [esp + 0x1c0]
call fcn.0064cb00
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.0064c8f0
mov edx, 0x64
lea ecx, [esp + 0x15c]
call fcn.0064ca10
lea ecx, [esp + 0x10]
push ecx
xor eax, eax
push 0x20019
mov dword [esp + 0x28], eax
push ebx
lea edx, [esp + 0xa0]
mov dword [esp + 0x30], eax
push edx
mov dword [esp + 0x38], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x40], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x657fcb
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x657fcb
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x40]
push ecx
mov ebx, 4
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0
call edi
test eax, eax
jne 0x657f69
cmp dword [esp + 0x14], ebx
jne 0x657f69
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0
call edi
test eax, eax
jne 0x657f69
cmp dword [esp + 0x14], ebx
jne 0x657f69
mov ecx, dword [esp + 0x1c]
push ecx
push 0x6dc904
lea edx, [esp + 0x28]
push 0xd
push edx
call fcn.006976f4
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x657f53
sub eax, edx
push ebp
push esi
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.00657cb0
call fcn.006553b0
cmp eax, 1
je 0x657f85
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x100]
call fcn.00657d30
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x164]
call fcn.00657d30
call fcn.00655400
cmp eax, 1
je 0x657fb3
mov ecx, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x1c8]
call fcn.00657d30
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret
pop edi
pop esi
pop ebp
mov eax, 0x338
pop ebx
add esp, 0x214
ret
pop esi
pop ebp
mov eax, 0x325
pop ebx
add esp, 0x214
ret