joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d9c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov eax, 0x200c
lea ebp, [esp - 0x1f8c]
call fcn.004144e0
mov eax, dword [0x41888c]
push esi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp + 0x1f88], eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x1f94]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40da34
cmp dword [ebp - 0x7c], 1
jne 0x40da38
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push dword [ebp + 0x1f94]
mov dword [ebp - 0x80], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40da34
cmp word [ebp - 0x78], si
je 0x40da34
inc eax
jmp 0x40da41
xor eax, eax
jmp 0x40da41
xor eax, eax
cmp eax, dword [ebp - 0x7c]
sbb eax, eax
neg eax
mov ecx, dword [ebp + 0x1f88]
pop esi
call fcn.004140f1
add ebp, 0x1f8c
leave
ret 4

Function at 0x40dfce
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x414787
call fcn.00414400
sub esp, 0x214
mov eax, dword [0x41888c]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
mov dword [ebp - 0x214], esi
push 0x2001f
push dword [ebp + 8]
lea ecx, [ebp - 0x214]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.0040d3de
cmp eax, esi
jne 0x40e06d
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40e027
lea eax, [ebp - 0x210]
push eax
call fcn.0040dfce
cmp eax, esi
jne 0x40e06c
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x40e017
call fcn.0040d379
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.0040d379
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004140f1
leave
ret 4
Function at 0x40fe50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4148b3
call fcn.00414400
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
push 2
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
call fcn.0040eb88
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x14], esi
jne 0x40feac
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40fe97
call esi
mov esi, eax
jmp 0x40ffc5
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x40ffc5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, edi
je 0x40fecd
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, edi
jne 0x40fef5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40fee0
call esi
jmp 0x40ffba
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x40ffbc
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x40ff63
lea edi, [ebx + 1]
cmp edi, 0x400
ja 0x40ff30
push edi
call fcn.0040d297
test al, al
je 0x40ff30
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.004144e0
mov dword [ebp + 8], esp
jmp 0x40ff3c
push edi
lea ecx, [ebp - 0x10]
call fcn.0040eb65
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40ff4a
mov esi, 0x8007000e
jmp 0x40ffbc
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov byte [eax + ebx], 0
test edi, edi
jne 0x40ff6b
xor eax, eax
jmp 0x40ffae
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x40ff9b
push ebx
call fcn.0040d297
test al, al
je 0x40ff9b
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.004144e0
mov eax, esp
jmp 0x40ffa4
push ebx
lea ecx, [ebp - 0x10]
call fcn.0040eb65
push 0
push esi
push edi
push eax
call fcn.0040d2f2
push dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0040f7ae
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x10]
call fcn.0040de40
mov eax, esi
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4140f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41888c]
jne 0x4140fa
ret
jmp 0x4140ff
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x41888c]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x418a20]
test eax, eax
je 0x414123
call eax
cmp dword [0x418a24], 0
je 0x41416a
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x418a24]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.004140f1
add ebp, 0x2a8
leave
ret
Function at 0x40c944
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x4b6c54
push 0xa
push 0x40c9d8
mov eax, dword [0x4b6c3c]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40c968
call fcn.004175e4
push ebx
mov eax, dword [0x4b6c3c]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40c97f
call fcn.004175e4
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40c991
call fcn.004175e4
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x4b6c58], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x4b6c5c], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x4b6c60], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x4b6c64], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x4b6c68], ecx
add edx, dword [eax + 0x14]
mov dword [0x4b6c6c], edx
pop esi
pop ebx
ret

Function at 0x410288
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x410331
test eax, edx
je 0x410334
push 0
push 0
cmp word [eax - 0xa], 2
je 0x4102b1
push edx
mov edx, eax
mov eax, esp
call fcn.00406a64
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x4102c7
push eax
lea eax, [esp + 8]
call fcn.00406a64
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4102d6
movzx eax, word [eax]
sub eax, ecx
jmp 0x4102fd
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x410317
add ecx, 4
js 0x4102ee
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x410314
push eax
mov eax, ecx
mov edx, 2
call fcn.0040607c
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4102fb
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4102fd
xor eax, eax
ret
test eax, eax
je 0x410344
test edx, edx
jne 0x410298
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4149a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4149dd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040699c
jmp 0x4149e6
mov eax, ebx
mov edx, esi
call fcn.00406860
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4149f0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x414a12
movzx eax, word [esp]
jmp 0x414a14
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4151a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4152c9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00414fb4
mov esi, eax
mov eax, dword [0x4b3244]
cmp byte [eax], 0
je 0x415271
mov eax, dword [0x4b3000]
call fcn.0040467c
call fcn.0040433c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41517c]
call fcn.00408024
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4152e4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4152ad
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4b2f9c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4b6c3c]
call fcn.00408118
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4152d0
lea eax, [ebp - 4]
mov edx, dword [0x41517c]
call fcn.00408030
ret

Function at 0x416480
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x416556
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004068b4
lea eax, [ebp - 4]
call fcn.0040724c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004068ec
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x416540
mov eax, ebx
call fcn.004041d4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x416539
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004068ec
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x416523
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x416568
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x416523
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416540
mov eax, dword [ebp - 0x10]
call fcn.004041f0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41655d
lea eax, [ebp - 4]
call fcn.00406850
ret
Function at 0x41748c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040638c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x417436
mov eax, edi
add eax, eax
call fcn.004041d4
mov esi, eax
jmp 0x417438
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x417471
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41745b
mov eax, esp
cmp esi, eax
je 0x41747e
mov eax, esi
call fcn.004041f0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4174b8
cmp bl, 0
je 0x4174b4
cmp bl, 0x41
jl 0x4174af
cmp bl, 0x5a
jg 0x4174af
or bl, 0x20
xor al, bl
inc esi
jmp 0x417493
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4173f8

Function at 0x43a4fc
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x43a59a
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x43a55e
cmp byte [ebx + 0x10], 0
jne 0x43a55e
cmp byte [ebx + 0x3c], 0
jne 0x43a55e
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x43a57f
lea edx, [ebp - 4]
mov eax, dword [0x4b31f0]
call fcn.0040990c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x42b098]
call fcn.004152e8
call fcn.00405868
jmp 0x43a57f
lea edx, [ebp - 8]
mov eax, dword [0x4b31f0]
call fcn.0040990c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x42b098]
call fcn.004152e8
call fcn.00405868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a5a1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406858
ret

Function at 0x43ae18
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x43ae66
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0043a480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43ae7f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43ae88
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0043a480
dec esi
jne 0x43aeaa
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x43c6c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4b8f94
cmp dword [edi], 0
jne 0x43c740
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4b8f90]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b1fd4
mov ecx, 2
call fcn.0040438c
mov edx, 0x43c69c
lea eax, [esi + 5]
call fcn.0043c6bc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043c6bc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43c715
mov dword [0x4b8f90], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x443914
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x443a8f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004068b4
mov eax, dword [ebp - 4]
call fcn.004431ac
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x443966
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407058
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004445c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x443a45
xor eax, eax
push ebp
push 0x443a3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00443514
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00443ac4
test al, al
je 0x443a1c
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040699c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x443a1c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004068ec
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00443474
test al, al
je 0x443a16
mov eax, dword [ebp - 8]
call fcn.004068ec
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00406a0c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00443914
dec ebx
cmp ebx, 0xffffffff
jne 0x4439c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443a45
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00443514
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.004068ec
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00443500
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00443474
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443a96
lea eax, [ebp - 0x3c]
call fcn.00406850
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406858
ret

Function at 0x44449c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00443220
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004068ec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.00443474
test al, al
jne 0x444504
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4b3150]
mov dl, 1
mov eax, dword [0x441fd0]
call fcn.004154ec
call fcn.00405868
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x444510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004068ec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.00443474
test al, al
jne 0x444571
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4b3388]
mov dl, 1
mov eax, dword [0x441fd0]
call fcn.004154ec
call fcn.00405868
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00443250
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x444b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x444c98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00443514
xor eax, eax
push ebp
push 0x444c73
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443ac4
test al, al
je 0x444c57
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00444a50
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040699c
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x444c57
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004068ec
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443474
test al, al
je 0x444c53
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004068ec
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00406a0c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00444a50
pop ecx
inc edi
dec ebx
jne 0x444bfb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444c7a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00443514
ret
Function at 0x444ca8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x444ef6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00443514
xor eax, eax
push ebp
push 0x444ecc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443ac4
test al, al
je 0x444eb0
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040699c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x444eb0
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.004068ec
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443474
test al, al
je 0x444ea4
mov eax, dword [ebp - 4]
call fcn.004068ec
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00406a0c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004445c0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x444ea4
xor eax, eax
push ebp
push 0x444e9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.00443514
xor eax, eax
push ebp
push 0x444e7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004068ec
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00406a0c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443518
mov eax, dword [ebp - 4]
call fcn.004068ec
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00406a0c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004445c0
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x444e5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00444b70
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00444ca8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444e63
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x444d33
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444ed3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00443514
ret