joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3a10
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbf70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
push 0xf003f
push ebx
push ecx
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4b3bc1
push str.1......
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
push ebx
push ebx
mov ecx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push str.2......
mov ecx, 0xf558a0
mov esi, eax
call fcn.004f0087
push 0xea
mov ecx, eax
call fcn.004f0ba3
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
cmp esi, 0xea
je 0x4b3b2c
test esi, esi
je 0x4b3b2c
cmp esi, 0x103
jne 0x4b3b16
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x120]
push eax
rep stosd dword es:[edi], eax
push eax
push eax
lea ecx, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x120]
push ecx
push edx
push ebx
push eax
mov dword [ebp - 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push str.3......
mov ecx, 0xf558a0
mov esi, eax
call fcn.004f0087
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.004f0509
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
inc ebx
cmp esi, 0xea
je 0x4b3ba3
test esi, esi
jne 0x4b3aca
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x120]
push ecx
push edx
call fcn.004b3a10
add esp, 8
jmp 0x4b3aca
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3de0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x2004
call fcn.004f2630
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
push 0x1ffe
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 0x14]
lea ebx, [esp + 0x14]
test al, al
je 0x4b3e95
mov ecx, dword [esp + 0x2018]
mov dword [esp + 0x10], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
add eax, 0xc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x10], eax
and ecx, 3
inc ebp
cmp ebp, 0x19
rep movsb byte es:[edi], byte [esi]
je 0x4b3e7d
push 0
push ebx
call fcn.004f3240
add esp, 8
inc eax
mov ebx, eax
cmp byte [ebx], 0
jne 0x4b3e1b
mov eax, dword [esp + 0x201c]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
mov ax, 1
pop ebx
add esp, 0x2004
ret
mov ecx, dword [esp + 0x201c]
pop edi
pop esi
mov ax, 1
mov dword [ecx], ebp
pop ebp
pop ebx
add esp, 0x2004
ret
mov edx, dword [esp + 0x201c]
pop edi
pop esi
mov ax, 1
mov dword [edx], ebp
pop ebp
pop ebx
add esp, 0x2004
ret

Function at 0x4b3eb0
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
movsx ecx, byte [eax]
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x4b3ec3
jmp dword [ecx*4 + 0x4b3f9c]
mov byte [eax], 0x41
mov ax, 1
ret
mov byte [eax], 0x42
mov ax, 1
ret
mov byte [eax], 0x43
mov ax, 1
ret
mov byte [eax], 0x44
mov ax, 1
ret
mov byte [eax], 0x45
mov ax, 1
ret
mov byte [eax], 0x46
mov ax, 1
ret
mov byte [eax], 0x47
mov ax, 1
ret
mov byte [eax], 0x48
mov ax, 1
ret
mov byte [eax], 0x49
mov ax, 1
ret
mov byte [eax], 0x4a
mov ax, 1
ret
mov byte [eax], 0x4b
mov ax, 1
ret
mov byte [eax], 0x4c
mov ax, 1
ret
mov byte [eax], 0x4d
mov ax, 1
ret
mov byte [eax], 0x4e
mov ax, 1
ret
mov byte [eax], 0x4f
mov ax, 1
ret
mov byte [eax], 0x50
mov ax, 1
ret
mov byte [eax], 0x51
mov ax, 1
ret
mov byte [eax], 0x52
mov ax, 1
ret
mov byte [eax], 0x53
mov ax, 1
ret
mov byte [eax], 0x54
mov ax, 1
ret
mov byte [eax], 0x55
mov ax, 1
ret
mov byte [eax], 0x56
mov ax, 1
ret
mov byte [eax], 0x57
mov ax, 1
ret
mov byte [eax], 0x58
mov ax, 1
ret
mov byte [eax], 0x59
mov ax, 1
ret
mov byte [eax], 0x5a
mov ax, 1
ret
Function at 0x4b40f0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbf90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x748
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x754]
xor edi, edi
push eax
push ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
call fcn.004b4010
add esp, 8
cmp edi, dword [ebp - 0x14]
jge 0x4b41da
mov edx, edi
push 0x528bd0
shl edx, 6
lea esi, [ebp + edx - 0x754]
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4b41ad
push 0x528bcc
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4b41ad
push esi
call fcn.004abec0
add esp, 4
cmp eax, 1
jne 0x4b4191
test ebx, ebx
jne 0x4b4191
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.004c0aa0
add esp, 8
mov ebx, 1
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.004f2cb8
add esp, 4
inc edi
jmp 0x4b4131
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b41f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
mov dword [esp + 8], 1
call fcn.004fa6c0
add esp, 4
lea ecx, [esp + 8]
lea edx, [esp]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0xc30c0c
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4b424d
mov ecx, dword [esp]
lea eax, [esp + 4]
push 4
push eax
push 4
push 0
push str.AlwaysUnloadDll
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret

Function at 0x4b4270
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
mov dword [esp + 8], 5
call fcn.004fa6c0
add esp, 4
lea ecx, [esp + 8]
lea edx, [esp]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0xc30c0c
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4b42cd
mov ecx, dword [esp]
lea eax, [esp + 4]
push 4
push eax
push 4
push 0
push str.EnablePrefetcher
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret
Function at 0x4b45a0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0xc
push str.SYSTEMCurrentControlSetServicesERsvc
mov dword [esp + 8], 4
call fcn.004fa6c0
add esp, 4
lea ecx, [esp + 8]
lea edx, [esp]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0xc30c0c
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4b45fd
mov ecx, dword [esp]
lea eax, [esp + 4]
push 4
push eax
push 4
push 0
push str.start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.c:endpcache
call fcn.004f2beb
mov eax, 1
add esp, 0x10
ret

Function at 0x4b4620
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b4664
lea ecx, [esp + 8]
push ecx
push str..cmd
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str..cmd
push closesocket
call esi
test eax, eax
je 0x4b4699
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x94]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x94]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b471a
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push str.cmdfile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b4747
push edi
push str.cmdfile
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov ecx, dword [esp + 8]
push ecx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret
Function at 0x4b4760
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b47a4
lea ecx, [esp + 8]
push ecx
push str..bat
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str..bat
push closesocket
call esi
test eax, eax
je 0x4b47d9
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x94]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x94]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b485a
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push str.batfile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b4894
push edi
push str.batfile
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp + 8]
push edx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret
Function at 0x4b48b0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b48f4
lea ecx, [esp + 8]
push ecx
push str..rtf
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str..rtf
push closesocket
call esi
test eax, eax
je 0x4b4929
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x94]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x94]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b49aa
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push str.rtffile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b49e4
push edi
push str.rtffile
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp + 8]
push edx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret
Function at 0x4b4a00
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b4a44
lea ecx, [esp + 8]
push ecx
push str..inf
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str..inf
push closesocket
call esi
test eax, eax
je 0x4b4a79
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x94]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x94]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b4afa
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push str.inffile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b4b34
push edi
push str.inffile
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp + 8]
push edx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret
Function at 0x4b4b50
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b4b94
lea ecx, [esp + 8]
push ecx
push str..txt
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str..txt
push closesocket
call esi
test eax, eax
je 0x4b4bc9
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x94]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x94]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b4c4a
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push str.txtfile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b4c84
push edi
push str.txtfile
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp + 8]
push edx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret
Function at 0x4b4ca0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b4ce4
lea ecx, [esp + 8]
push ecx
push str..cpl
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str..cpl
push closesocket
call esi
test eax, eax
je 0x4b4d19
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x94]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x94]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b4d9a
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push str.cplfile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b4dd4
push edi
push str.cplfile
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp + 8]
push edx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret
Function at 0x4b4df0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b4e34
lea ecx, [esp + 8]
push ecx
push str..com
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str..com
push closesocket
call esi
test eax, eax
je 0x4b4e69
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x94]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x94]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b4eea
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push str.comfile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b4f24
push edi
push str.comfile
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp + 8]
push edx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret
Function at 0x4b4f40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b4f84
lea ecx, [esp + 8]
push ecx
push 0x50d604
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push 0x50d604
push closesocket
call esi
test eax, eax
je 0x4b4fb9
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
push edi
push str.exefile
call fcn.004fa6c0
add esp, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
lea edx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x28], 1
call edi
lea edx, [esp + 0x14]
lea eax, [esp + 0x98]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edx
call edi
test eax, eax
jne 0x4b504a
lea eax, [esp + 0x98]
lea ecx, [esp + 0x18]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x24]
push str.exefile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b5066
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret
Function at 0x4b5080
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b50c4
lea ecx, [esp + 8]
push ecx
push str..pif
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str..pif
push closesocket
call esi
test eax, eax
je 0x4b50f9
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x94]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x94]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b517a
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push str.piffile
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4b51b4
push edi
push str.piffile
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp + 8]
push edx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x18c
ret