joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae500
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x210
push ebx
push esi
mov esi, dword [esp + 0x21c]
push edi
test esi, esi
jne 0x4ae520
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test bl, 1
mov dword [esp + 0xc], ebx
je 0x4ae53e
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x224]
push esi
test eax, eax
je 0x4ae57a
push str._s.tmp
lea eax, [esp + 0x1c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
jmp 0x4ae59e
push 0x4ed128
lea ecx, [esp + 0x1c]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x14]
push 0x4ef214
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x4ae5c1
pop edi
pop esi
pop ebx
add esp, 0x210
ret
push ebp
push edi
push 1
lea eax, [esp + 0x1c]
push 2
push eax
mov dword [esp + 0x24], 0xfeff
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebp, dword [esi + 0x20c]
add esp, 0x10
test ebp, ebp
je 0x4ae62a
mov ebx, dword [sym.imp.MSVCRT.dll_fwprintf]
mov ecx, dword [ebp]
push ecx
push str._r_n_s_r_n
push edi
call ebx
mov esi, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x4ae618
mov edx, dword [esi]
push edx
push str._s_r_n
push edi
call ebx
mov esi, dword [esi + 4]
add esp, 0xc
test esi, esi
jne 0x4ae603
mov ebp, dword [ebp + 8]
test ebp, ebp
jne 0x4ae5ed
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x224]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x22c]
add esp, 4
test eax, eax
pop ebp
je 0x4ae678
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x73eebc]
test eax, eax
je 0x4ae66a
lea eax, [esp + 0x14]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4ae678
push 1
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x210
ret
Function at 0x4aea50
Capabilities:
Move file

Disassembly:
sub esp, 0x208
push esi
push edi
call fcn.004ae970
mov esi, eax
push 0
push esi
call fcn.004a8e00
add esp, 8
test eax, eax
jne 0x4aeacb
mov eax, dword [esp + 0x214]
test eax, eax
je 0x4aea80
mov edi, 2
jmp 0x4aead0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push str._s.tmp
lea eax, [esp + 0x10]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.004a8e00
add esp, 0x18
test eax, eax
je 0x4aeaf5
lea edx, [esp + 8]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, 1
push 0x73da80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
push esi
push 0x73dca0
call fcn.004ada90
add esp, 0xc
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4aebf0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x410
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fed68]
test eax, eax
je 0x4aecb4
push ebx
mov ebx, dword [esp + 0x420]
test ebx, ebx
jne 0x4aec2c
mov ebx, str.Main
push 1
call fcn.004aeb50
mov esi, eax
add esp, 4
xor edi, edi
cmp dword [esi], 0
je 0x4aeca8
mov word [esp + 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push str.__s_
lea eax, [esp + 0x21c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 0x73da80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x424]
mov eax, dword [esi]
lea edx, [esp + 0x214]
push ecx
push edx
push eax
call fcn.004ae790
add esp, 0xc
mov edi, eax
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x410
ret
lea ecx, [esp + 8]
push str.SoftwarePhoenix
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x424]
add esp, 8
test edi, edi
je 0x4aecef
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea edx, [esp + 8]
push 0x4ef314
push edx
call esi
lea eax, [esp + 0x10]
push edi
push eax
call esi
add esp, 0x10
mov ecx, dword [esp + 0x420]
mov eax, dword [esp + 0x424]
lea edx, [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x410
ret
Function at 0x4aed20
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x410
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fed68]
test eax, eax
je 0x4aeddc
push ebx
mov ebx, dword [esp + 0x420]
test ebx, ebx
jne 0x4aed5c
mov ebx, str.Main
push 1
xor edi, edi
call fcn.004aeb50
mov esi, eax
add esp, 4
cmp dword [esi], 0
je 0x4aedd0
mov word [esp + 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push str.__s_
lea eax, [esp + 0x21c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push 0x73da80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esi]
lea ecx, [esp + 0x214]
push ecx
push edx
call fcn.004ae690
add esp, 8
mov edi, eax
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x410
ret
lea eax, [esp + 8]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x424]
add esp, 8
test edi, edi
je 0x4aee17
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 8]
push 0x4ef314
push ecx
call esi
lea edx, [esp + 0x10]
push edi
push edx
call esi
add esp, 0x10
mov ecx, dword [esp + 0x420]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x410
ret
Function at 0x4aee40
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x320c
call fcn.004d4ce0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
mov dword [esp + 0xc], 3
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fed68]
test eax, eax
je 0x4aef72
mov ebx, dword [esp + 0x321c]
test ebx, ebx
jne 0x4aee88
mov ebx, str.Main
push 0
call fcn.004aeb50
mov esi, eax
add esp, 4
cmp dword [esi], 0
je 0x4aef66
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x121a]
mov word [esp + 0x1218], 0
rep stosd dword es:[edi], eax
push 0x73da80
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x3220]
mov edx, dword [esi]
lea eax, [esp + 0x1218]
push 0xfff
push eax
push ecx
push ebx
push edx
call fcn.004ae040
add esp, 0x14
mov esi, eax
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4aef66
lea eax, [esp + 0x1218]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x4aef66
mov esi, dword [esp + 0x3228]
cdq
mov ecx, dword [esi]
sub eax, edx
sar eax, 1
dec eax
cmp ecx, eax
jae 0x4aef20
mov eax, ecx
lea ecx, [esp + 0x218]
push 0x1000
lea edx, [esp + 0x121c]
push ecx
push edx
mov dword [esi], eax
call fcn.004b1150
mov eax, dword [esi]
mov edx, dword [esp + 0x3230]
lea ecx, [esp + 0x224]
push eax
push ecx
push edx
call fcn.004b2c70
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x320c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x320c
ret
lea eax, [esp + 0x10]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x3224]
add esp, 8
test edi, edi
je 0x4aefad
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0x10]
push 0x4ef314
push ecx
call esi
lea edx, [esp + 0x18]
push edi
push edx
call esi
add esp, 0x10
mov eax, dword [esp + 0x3228]
mov ecx, dword [esp + 0x3224]
push eax
mov eax, dword [esp + 0x3224]
lea edx, [esp + 0x10]
push ecx
push edx
mov edx, dword [esp + 0x3238]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x320c
ret
Function at 0x4aeff0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x320c
call fcn.004d4ce0
push ebx
push ebp
mov ebp, dword [esp + 0x3224]
push esi
cmp ebp, 0xffe
push edi
jle 0x4af01a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x320c
ret
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [0x4fed68], ebx
je 0x4af0fd
mov ebp, dword [esp + 0x3220]
cmp ebp, ebx
jne 0x4af04c
mov ebp, str.Main
push 1
call fcn.004aeb50
mov esi, eax
add esp, 4
cmp dword [esi], ebx
je 0x4af0f0
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x21c]
lea edx, [esp + 0x21c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x322c]
mov ecx, dword [esp + 0x3228]
push eax
push ecx
push edx
call fcn.004b2cd0
lea eax, [esp + 0x1228]
push 0x1000
lea ecx, [esp + 0x22c]
push eax
push ecx
call fcn.004b11a0
lea edx, [esp + 0x1234]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x1c
test eax, eax
je 0x4af0f0
push 0x73da80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x3224]
mov edx, dword [esi]
lea eax, [esp + 0x121c]
push eax
push ecx
push ebp
push edx
call fcn.004ae220
add esp, 0x10
mov ebx, eax
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x320c
ret
lea eax, [esp + 0x14]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x3228]
add esp, 8
cmp edi, ebx
je 0x4af138
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0x14]
push 0x4ef314
push ecx
call esi
lea edx, [esp + 0x1c]
push edi
push edx
call esi
add esp, 0x10
mov edx, dword [esp + 0x3230]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ebx
push ecx
push edx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jl 0x4af192
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4af192
mov ecx, dword [esp + 0x3228]
mov edx, dword [esp + 0x3224]
push ebp
push ecx
push 3
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
pop edi
pop esi
pop ebp
pop ebx
setge al
add esp, 0x320c
ret
Function at 0x4af1b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fed68]
mov dword [esp + 8], 1
test eax, eax
je 0x4af24b
push ebx
mov ebx, dword [esp + 0x220]
test ebx, ebx
jne 0x4af1f0
mov ebx, str.Main
push 0
call fcn.004aeb50
mov esi, eax
add esp, 4
xor edi, edi
cmp dword [esi], 0
je 0x4af23f
push 0x73da80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
push eax
mov eax, dword [esi]
push ecx
push edx
push ebx
push eax
call fcn.004ae040
add esp, 0x14
mov edi, eax
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x210
ret
lea ecx, [esp + 0x10]
push str.SoftwarePhoenix
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x224]
add esp, 8
test edi, edi
je 0x4af286
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea edx, [esp + 0x10]
push 0x4ef314
push edx
call esi
lea eax, [esp + 0x18]
push edi
push eax
call esi
add esp, 0x10
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x224]
lea edx, [ecx + ecx]
mov ecx, dword [esp + 0x228]
mov dword [esp + 0x10], edx
lea edx, [esp + 0xc]
push ecx
push edx
mov edx, dword [esp + 0x238]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x210
ret
Function at 0x4af2d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fed68]
test eax, eax
je 0x4af35b
push ebx
mov ebx, dword [esp + 0x21c]
test ebx, ebx
jne 0x4af308
mov ebx, str.Main
push 1
call fcn.004aeb50
mov esi, eax
add esp, 4
xor edi, edi
cmp dword [esi], 0
je 0x4af34f
push 0x73da80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x220]
mov edx, dword [esi]
push eax
push ecx
push ebx
push edx
call fcn.004ae220
add esp, 0x10
mov edi, eax
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x20c
ret
lea eax, [esp + 0xc]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x220]
add esp, 8
test edi, edi
je 0x4af396
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0xc]
push 0x4ef314
push ecx
call esi
lea edx, [esp + 0x14]
push edi
push edx
call esi
add esp, 0x10
mov edx, dword [esp + 0x228]
lea eax, [esp + 8]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x24]
push 0
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jl 0x4af41a
mov eax, dword [esp + 8]
test eax, eax
je 0x4af41a
mov eax, dword [esp + 0x224]
mov esi, dword [esp + 0x220]
cmp eax, 0xffffffff
jne 0x4af3f4
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
shl eax, 1
jmp 0x4af3f6
add eax, eax
mov ecx, dword [esp + 8]
push eax
mov eax, dword [esp + 0x220]
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
setge al
add esp, 0x20c
ret
Function at 0x4af430
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [0x4fed68]
test eax, eax
je 0x4af531
mov ebx, dword [esp + 0x428]
test ebx, ebx
jne 0x4af479
mov ebx, str.Main
push 0
call fcn.004aeb50
mov esi, eax
add esp, 4
cmp dword [esi], 0
je 0x4af525
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21e]
mov word [esp + 0x21c], 0
rep stosd dword es:[edi], eax
push 0x73da80
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x42c]
mov edx, dword [esi]
lea eax, [esp + 0x21c]
push 0x103
push eax
push ecx
push ebx
push edx
call fcn.004ae040
add esp, 0x14
mov esi, eax
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4af525
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x4af525
lea ecx, [esp + 0x21c]
push ecx
call dword [sym.imp.MSVCRT.dll__wtoi]
mov edx, dword [esp + 0x434]
add esp, 4
pop edi
mov dword [edx], eax
pop esi
mov eax, 1
pop ebx
add esp, 0x418
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x418
ret
lea eax, [esp + 0x14]
push str.SoftwarePhoenix
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x430]
add esp, 8
test edi, edi
je 0x4af56c
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0x14]
push 0x4ef314
push ecx
call esi
lea edx, [esp + 0x1c]
push edi
push edx
call esi
add esp, 0x10
mov ecx, dword [esp + 0x430]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x430]
lea edx, [esp + 0x10]
push ecx
push edx
mov edx, dword [esp + 0x440]
lea ecx, [esp + 0x20]
push eax
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x418
ret
Function at 0x4af610
Capabilities:
Set registry value

Disassembly:
sub esp, 0x414
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fed68]
test eax, eax
je 0x4af6db
push ebx
mov ebx, dword [esp + 0x424]
test ebx, ebx
jne 0x4af64c
mov ebx, str.Main
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x42c]
lea ecx, [esp + 0x218]
push eax
push 0x4f30c8
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 1
call fcn.004aeb50
mov esi, eax
add esp, 0x14
xor edi, edi
cmp dword [esi], 0
je 0x4af6cf
push 0x73da80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x428]
mov ecx, dword [esi]
lea edx, [esp + 0x218]
push edx
push eax
push ebx
push ecx
call fcn.004ae220
add esp, 0x10
mov edi, eax
push 0x73da80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x414
ret
lea edx, [esp + 0xc]
push str.SoftwarePhoenix
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x428]
add esp, 8
test edi, edi
je 0x4af716
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [esp + 0xc]
push 0x4ef314
push eax
call esi
lea ecx, [esp + 0x14]
push edi
push ecx
call esi
add esp, 0x10
mov ecx, dword [esp + 0x42c]
lea edx, [esp + 8]
push 0
push edx
push 0
push 0xf003f
push 0
push 0
lea eax, [esp + 0x24]
push 0
push eax
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jl 0x4af77b
mov eax, dword [esp + 8]
test eax, eax
je 0x4af77b
mov ecx, dword [esp + 0x424]
lea edx, [esp + 0x428]
push 4
push edx
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
setge al
pop esi
add esp, 0x414
ret

Function at 0x4af790
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 8
mov eax, dword [0x4fed68]
mov dword [esp + 4], 0
test eax, eax
je 0x4af7c6
push 0
call fcn.004aeb50
mov eax, dword [eax]
add esp, 4
test eax, eax
je 0x4af814
mov ecx, dword [esp + 0xc]
push ecx
push eax
call fcn.004ae8e0
add esp, 8
add esp, 8
ret
mov eax, dword [esp + 0xc]
lea edx, [esp]
push edx
push eax
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [esp]
test eax, eax
je 0x4af814
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_SHQueryInfoKeyW]
test eax, eax
je 0x4af809
mov dword [esp + 4], 0
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 8
ret
Function at 0x4af910
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x24]
sub esp, 0x208
test eax, eax
je 0x4af92d
mov ecx, dword [0x4fed68]
xor eax, eax
test ecx, ecx
sete al
jmp 0x4af932
mov eax, dword [0x4fed68]
push esi
push edi
test eax, eax
je 0x4af9c9
push ebx
mov ebx, dword [esp + 0x21c]
test ebx, ebx
jne 0x4af94d
mov ebx, str.Main
push 0
mov esi, 1
call fcn.004aeb50
mov edi, eax
add esp, 4
cmp dword [edi], 0
je 0x4af9bd
mov eax, dword [esp + 0x22c]
push 0x73da80
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x234]
mov edx, dword [esp + 0x230]
mov eax, dword [esp + 0x228]
push ecx
mov ecx, dword [esp + 0x228]
push edx
mov edx, dword [esp + 0x228]
push eax
mov eax, dword [edi]
push ecx
push ebx
push edx
push eax
call fcn.004adee0
mov esi, eax
add esp, 0x1c
neg esi
sbb esi, esi
push 0x73da80
inc esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 0x208
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push str.SoftwarePhoenix
push ecx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [esp + 0x220]
add esp, 8
test edi, edi
je 0x4afa1a
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea edx, [esp + 8]
push 0x4ef314
push edx
call esi
lea eax, [esp + 0x10]
push edi
push eax
call esi
add esp, 0x10
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x22c]
mov eax, dword [esp + 0x228]
push ecx
mov ecx, dword [esp + 0x228]
push edx
mov edx, dword [esp + 0x228]
push eax
mov eax, dword [esp + 0x228]
push ecx
mov ecx, dword [esp + 0x224]
push edx
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHEnumValueW]
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4afa70
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push edi
je 0x4afb08
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x4afb08
mov eax, dword [0x73eec4]
test eax, eax
je 0x4afafc
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4afb08
push esi
push str.RegDeleteTreeW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4afaf1
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push 0
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4afaea
push ebx
push eax
call esi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
pop ebx
ret
mov edx, dword [esp + 0xc]
push ebx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
pop edi
pop ebx
ret