joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a071
Capabilities:
Create process on windows

Disassembly:
push 0x60
mov eax, 0x457400
call fcn.00450aac
mov bl, dl
mov dword [ebp - 0x14], ecx
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.00438510
add esp, 0xc
mov dword [ebp - 0x6c], edi
test bl, bl
je 0x42a0a9
xor eax, eax
mov dword [ebp - 0x40], 1
mov word [ebp - 0x3c], ax
push dword [ebp - 0x14]
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00419772
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push dword [eax - 8]
lea ecx, [ebp - 0x14]
call fcn.004191a9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42a129
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42a0fd
movzx esi, si
or esi, 0x80070000
push esi
push 0x410ec0
push dword [0x460620]
call fcn.0042b260
add esp, 0xc
mov ecx, esi
call fcn.0042acdf
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0041920f
mov esi, 0x80004005
jmp 0x42a157
cmp dword [ebp + 8], 0
je 0x42a13b
push dword [ebp + 8]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0041920f
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.00419240
mov eax, esi
call fcn.00450a75
ret 4

Function at 0x42a169
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 9
pop esi
xor eax, eax
lea edi, [ebp - 0x24]
mov ecx, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp si, word [ebp - 0x24]
pop edi
pop esi
je 0x42a19c
push 6
pop eax
cmp ax, word [ebp - 0x24]
je 0x42a19c
xor eax, eax
jmp 0x42a19f
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret

Function at 0x42a1a3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 6
pop ecx
xor eax, eax
cmp cx, word [ebp - 0x24]
pop edi
sete al
mov esp, ebp
pop ebp
ret

Function at 0x42a1cf
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 9
pop esi
xor eax, eax
lea edi, [ebp - 0x24]
mov ecx, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp si, word [ebp - 0x24]
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42a48e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x45d014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call fcn.00438510
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0043567f
mov esp, ebp
pop ebp
ret

Function at 0x42a5c8
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x45d014]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x20c]
push ebx
push esi
push edi
mov edi, 0x104
mov esi, ecx
push edi
push eax
mov dword [ebp - 0x210], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
lea ebx, [edi - 2]
cmp eax, ebx
lea eax, [ebp - 0x20c]
ja 0x42a629
push eax
mov ecx, esi
call fcn.00419772
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043567f
mov esp, ebp
pop ebp
ret
push edi
push eax
push 0x411528
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, ebx
ja 0x42a645
lea eax, [ebp - 0x20c]
jmp 0x42a60e
test eax, eax
jle 0x42a651
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x210]
call fcn.00418994
push 0x45c73c
mov eax, ecx
push eax
call fcn.0043866a
int3
Function at 0x42a8da
Capabilities:
Check os version
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x45d014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x114
lea eax, [ebp - 0x128]
push esi
xor edi, edi
push edi
push eax
call fcn.00438510
add esp, 0xc
mov dword [ebp - 0x128], esi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 2
pop esi
test eax, eax
je 0x42a9cc
cmp dword [ebp - 0x118], esi
jne 0x42a9cc
lea eax, [ebp - 0x12c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebx, ebx
inc ebx
test eax, eax
je 0x42a99a
lea eax, [ebp - 0x134]
push eax
push 0x411578
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x134]
push edi
push edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x130]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 0x12c]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x124], 5
ja 0x42a9ba
jne 0x42a9ad
cmp dword [ebp - 0x120], edi
ja 0x42a9ba
push ebx
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
jmp 0x42a9d4
push 0x80000000
push ebx
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x42a9d4
push edi
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043567f
mov esp, ebp
pop ebp
ret
Function at 0x42aa52
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x148
mov eax, 0x457540
call fcn.00450ae0
push 0x118
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00438510
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
xor eax, eax
lea edi, [ebp - 0x154]
push 9
pop esi
mov ecx, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [0x45d9d0]
mov dword [ebp - 0x130], eax
and dword [ebp - 4], 0
movzx eax, word [ebp - 0x154]
test eax, eax
je 0x42aadb
cmp eax, 6
je 0x42aad4
lea ecx, [ebp - 0x130]
cmp eax, esi
je 0x42aacd
push 0x4115b8
jmp 0x42aae6
push 0x4115ac
jmp 0x42aae6
push 0x4115a0
jmp 0x42aae0
push 0x4115c8
lea ecx, [ebp - 0x130]
call fcn.00418ba7
push dword [ebp - 0x130]
push 0x4115f4
push dword [0x460620]
call fcn.0042b292
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ac9a
cmp dword [ebp - 0x11c], 2
jne 0x42ac1e
mov eax, dword [ebp - 0x128]
cmp eax, 6
jbe 0x42ab3b
push 0x4115d0
jmp 0x42ac23
jne 0x42abad
mov eax, dword [ebp - 0x124]
test eax, eax
jne 0x42ab67
cmp byte [ebp - 0x12], 1
lea ecx, [ebp - 0x130]
jne 0x42ab5d
push 0x411654
jmp 0x42ac29
push 0x41162c
jmp 0x42ac29
cmp eax, 1
jne 0x42ab8b
lea ecx, [ebp - 0x130]
cmp byte [ebp - 0x12], al
jne 0x42ab81
push 0x4116a0
jmp 0x42ac29
push 0x411670
jmp 0x42ac29
cmp eax, 2
jne 0x42ab31
cmp byte [ebp - 0x12], 1
lea ecx, [ebp - 0x130]
jne 0x42aba6
push 0x4116d8
jmp 0x42ac29
push 0x4116b4
jmp 0x42ac29
cmp eax, 5
jne 0x42ac05
mov eax, dword [ebp - 0x124]
sub eax, 0
je 0x42abfe
sub eax, 1
je 0x42abf7
sub eax, 1
jne 0x42ac2e
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x42abda
push 0x411738
jmp 0x42ac23
cmp byte [ebp - 0x12], 1
jne 0x42abf0
cmp si, word [ebp - 0x154]
jne 0x42abf0
push 0x4116f0
jmp 0x42ac23
push 0x411780
jmp 0x42ac23
push 0x411768
jmp 0x42ac23
push 0x4117dc
jmp 0x42ac23
lea ecx, [ebp - 0x130]
cmp eax, 4
ja 0x42ac17
push 0x4117a8
jmp 0x42ac29
push 0x411808
jmp 0x42ac29
push 0x4117a8
lea ecx, [ebp - 0x130]
call fcn.00418ba7
push dword [ebp - 0x130]
push 0x4117f8
push dword [0x460620]
call fcn.0042b292
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push 0x411860
push dword [0x460620]
call fcn.0042b292
mov cx, word [ebp - 0x18]
add esp, 0x20
mov eax, 0x40c798
test cx, cx
je 0x42ac7d
lea eax, [ebp - 0x118]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, cx
push eax
push 0x411820
push dword [0x460620]
call fcn.0042b292
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push eax
push 0x4118c8
push dword [0x460620]
call fcn.0042b292
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
push 0x41188c
push dword [0x460620]
call fcn.0042b292
add esp, 0xc
lea ecx, [ebp - 0x130]
call fcn.00419240
call fcn.00450a8a
ret
Function at 0x42b36d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x45d014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x418]
mov esi, 0x100
push eax
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x42b3a5
call fcn.00425904
jmp 0x42b460
cmp eax, esi
jbe 0x42b3b3
mov eax, 0x80020013
jmp 0x42b460
lea eax, [ebp - 0x210]
xor esi, esi
push eax
push esi
push 0x411d5c
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x42b39b
push ebx
xor eax, eax
lea ebx, [edi + 8]
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
push 0x101
push ebx
call fcn.0043dad3
add esp, 0x10
mov ecx, eax
call fcn.004189bf
mov edx, 0x40000000
mov dword [ebp - 0x424], 0xc
mov dword [edi + 0x20c], edx
lea eax, [ebp - 0x424]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x41c], 1
test ecx, ecx
je 0x42b43b
sub esp, 0xc
push eax
push ecx
push edx
push ebx
call fcn.0042b2c4
jmp 0x42b44d
push esi
push 0x2100
push 2
push eax
push esi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop ebx
cmp eax, 0xffffffff
jne 0x42b45c
call fcn.00425904
mov esi, eax
jmp 0x42b45e
mov dword [edi], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043567f
mov esp, ebp
pop ebp
ret 8

Function at 0x42ba1b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push esi
push edi
xor edi, edi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x42ba29
sub edx, esi
lea eax, [ebp - 4]
push edi
sar edx, 1
push eax
lea eax, [edx + edx]
push eax
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
test eax, eax
jne 0x42ba57
call fcn.00425904
mov esp, ebp
pop ebp
ret 4
Function at 0x42ba9c
Capabilities:
Write file on windows

Disassembly:
push 0x220
mov eax, 0x4576f0
call fcn.00450ae0
mov edi, ecx
cmp byte [edi + 0x34], 0
je 0x42b7e8
push 0x411f10
push dword [0x460620]
call fcn.0042b2ab
pop ecx
pop ecx
xor eax, eax
jmp 0x42ba15
mov eax, dword [0x45d9d0]
mov dword [ebp - 0x224], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
push ecx
push ecx
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.0042b36d
push 0x412138
lea ecx, [ebp - 0x220]
call fcn.0042ba5d
push 0x412118
lea ecx, [ebp - 0x220]
call fcn.0042ba5d
push dword [edi + 0x30]
lea eax, [ebp - 0x224]
push 0x412158
push eax
call fcn.00418bd2
add esp, 0xc
lea ecx, [ebp - 0x220]
push dword [ebp - 0x224]
call fcn.0042ba5d
push 0x41213c
lea ecx, [ebp - 0x220]
call fcn.0042ba1b
mov eax, dword [edi + 4]
test eax, eax
jle 0x42b8a7
mov esi, ebx
test esi, esi
jle 0x42b88a
push 0x41218c
lea ecx, [ebp - 0x220]
call fcn.0042ba1b
push esi
mov ecx, edi
call fcn.0041a6a7
lea ecx, [ebp - 0x220]
push dword [eax]
call fcn.0042ba1b
inc esi
cmp esi, dword [edi + 4]
jl 0x42b876
jmp 0x42b8b7
push 0x412180
lea ecx, [ebp - 0x220]
call fcn.0042ba1b
push ebx
lea eax, [ebp - 0x22c]
push eax
push 4
push 0x40f214
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42b8db
call fcn.00425904
push 0x4121c0
lea ecx, [ebp - 0x220]
call fcn.0042ba5d
push 0x412190
lea ecx, [ebp - 0x220]
call fcn.0042ba5d
mov eax, ebx
push dword [edi + eax*4 + 0xc]
lea esi, [eax + 1]
push esi
lea eax, [ebp - 0x224]
push 0x4121f8
push eax
call fcn.00418bd2
add esp, 0x10
lea ecx, [ebp - 0x220]
push dword [ebp - 0x224]
call fcn.0042ba5d
mov eax, esi
cmp eax, 9
jl 0x42b8fd
push 0x4121e4
lea ecx, [ebp - 0x220]
call fcn.0042ba5d
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x42b956
call fcn.00425904
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x42b96b
call fcn.00425904
cmp dword [ebp - 0x220], 0
je 0x42b986
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], ebx
push 0x412228
push dword [0x460620]
call fcn.0042b292
mov eax, dword [0x45d9d0]
pop ecx
pop ecx
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 2
call fcn.0042b472
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 3
push ecx
push dword [eax]
lea eax, [ebp - 0x228]
push 0x412208
push eax
call fcn.00418bd2
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
call fcn.00419240
mov ecx, dword [ebp - 0x228]
mov dl, 1
push ebx
call fcn.0042a071
lea ecx, [ebp - 0x228]
mov esi, eax
call fcn.00419240
lea ecx, [ebp - 0x220]
call fcn.0042b33e
lea ecx, [ebp - 0x224]
call fcn.00419240
mov eax, esi
call fcn.00450a8a
ret
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x42babb
push 0x411f10
push dword [0x460620]
call fcn.0042b2ab
pop ecx
pop ecx
xor eax, eax
pop esi
ret
call fcn.0042b64f
cmp eax, 1
jne 0x42bab9
mov ecx, esi
pop esi
jmp 0x42b7b8
Function at 0x42c166
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x42c181
cmp dword [edi], 2
jae 0x42c181
push 0x7a
pop eax
jmp 0x42c1e0
mov eax, dword [edi]
push ebx
add eax, eax
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
mov dword [edi], ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42c1df
cmp dword [ebp - 8], 7
jne 0x42c1d4
mov ecx, dword [ebp - 4]
test esi, esi
je 0x42c1d9
test cl, 1
jne 0x42c1d4
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x42c1d4
cmp word [esi + eax*2 - 2], bx
jne 0x42c1d4
cmp eax, 1
jbe 0x42c1d9
cmp word [esi + eax*2 - 4], bx
je 0x42c1d9
push 0xd
pop eax
jmp 0x42c1df
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42c2f4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x45780b
call fcn.00450aac
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], ebx
push dword [edi + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42c34a
jle 0x42c334
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x18]
call fcn.00418994
push 0x45c73c
mov eax, ecx
push eax
call fcn.0043866a
mov eax, dword [ebp - 0x14]
test al, 1
jne 0x42c48c
push 2
pop edx
cmp dword [ebp - 0x10], edx
je 0x42c36d
cmp dword [ebp - 0x10], 7
je 0x42c36d
cmp dword [ebp - 0x10], 1
jne 0x42c48c
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00435a05
pop ecx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x42c3b3
mov eax, dword [ebp - 0x10]
cmp eax, 2
je 0x42c3d1
cmp eax, 7
je 0x42c3d1
cmp eax, 1
je 0x42c3d1
push 0xd
pop edi
test esi, esi
je 0x42c3be
push esi
call fcn.00435690
pop ecx
test edi, edi
jle 0x42c3cb
movzx edi, di
or edi, 0x80070000
push edi
jmp 0x42c335
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42c3da
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov ebx, dword [ebp + 8]
push esi
mov word [esi + eax*2 - 2], cx
mov ecx, ebx
call fcn.00419772
and dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x1c], 1
je 0x42c47b
xor eax, eax
cmp ax, word [esi]
je 0x42c42f
push esi
lea ecx, [ebp - 0x18]
call fcn.00419772
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], 1
call fcn.0041a6ca
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00419240
cmp dword [ebp - 0x10], 7
jne 0x42c47b
mov eax, dword [ebx]
mov eax, dword [eax - 8]
inc eax
lea edi, [esi + eax*2]
jmp 0x42c474
push edi
lea ecx, [ebp - 0x18]
call fcn.00419772
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], 2
call fcn.0041a6ca
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
mov eax, dword [eax - 8]
mov byte [ebp - 4], 0
lea edi, [edi + eax*2]
add edi, 2
call fcn.00419240
xor eax, eax
cmp ax, word [edi]
jne 0x42c440
push esi
call fcn.00435690
pop ecx
mov eax, ebx
call fcn.00450a75
ret 0x10
push 0x8007000d
jmp 0x42c335
Function at 0x42c496
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x45783f
call fcn.00450aac
xor edx, edx
lea eax, [ebp - 0x10]
push eax
push edx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edx
push eax
push edx
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
lea edi, [ecx + 4]
push dword [edi]
mov dword [ebp - 0x14], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42c4e9
jle 0x42c4d3
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x18]
call fcn.00418994
push 0x45c73c
mov eax, ecx
push eax
call fcn.0043866a
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [0x45d9d0]
shr edx, 1
inc edx
mov dword [ebp - 0x10], edx
mov dword [esi], eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x42c5e4
cmp eax, 2
jbe 0x42c5b0
cmp eax, 4
je 0x42c560
cmp eax, 7
jne 0x42c5e4
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push edx
call fcn.004191a9
push eax
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0042c166
push 0xffffffffffffffff
mov ecx, esi
mov edi, eax
call fcn.0041920f
test edi, edi
je 0x42c5a6
jle 0x42c55a
movzx edi, di
or edi, 0x80070000
push edi
jmp 0x42c4d4
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0042c0b7
test eax, eax
je 0x42c595
jle 0x42c580
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x20]
call fcn.00418994
push 0x45c73c
mov eax, ecx
jmp 0x42c4e3
push dword [ebp - 0x18]
push 0x40fa58
push esi
call fcn.00418bd2
add esp, 0xc
mov eax, esi
call fcn.00450a75
ret 8
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push edx
call fcn.004191a9
push eax
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0042c0f2
push 0xffffffffffffffff
mov ecx, esi
mov edi, eax
call fcn.0041920f
test edi, edi
je 0x42c5a6
jle 0x42c5e1
movzx edi, di
or edi, 0x80070000
push edi
jmp 0x42c581
push 0x8007000d
jmp 0x42c581
Function at 0x42c6a2
Capabilities:
Set registry value

Disassembly:
push 0x24
mov eax, 0x45786a
call fcn.00450aac
mov eax, ecx
mov dword [ebp - 0x24], eax
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.0042c2f4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], ebx
je 0x42c83a
cmp dword [ebp - 0x18], 7
jne 0x42c83a
mov byte [ebp - 0xd], bl
xor esi, esi
inc ebx
cmp dword [ebp - 0x2c], esi
jle 0x42c83a
push esi
lea ecx, [ebp - 0x30]
call fcn.0041a6a7
push dword [ebp + 0xc]
push dword [eax]
call fcn.0043bf87
pop ecx
pop ecx
test eax, eax
jne 0x42c723
mov al, 1
mov byte [ebp - 0xd], al
jmp 0x42c737
push esi
lea ecx, [ebp - 0x30]
call fcn.0041a6a7
inc ebx
mov eax, dword [eax]
mov eax, dword [eax - 8]
add ebx, eax
mov al, byte [ebp - 0xd]
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x42c703
test al, al
je 0x42c83a
inc ebx
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00435a05
mov edi, eax
lea eax, [ebx + ebx]
push eax
push 0
push edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
call fcn.00438510
add esp, 0x10
mov dword [ebp - 0x18], edi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x30]
call fcn.0041a6a7
push dword [ebp + 0xc]
push dword [eax]
call fcn.0043bf87
pop ecx
pop ecx
test eax, eax
je 0x42c7d9
push ebx
lea ecx, [ebp - 0x30]
call fcn.0041a6a7
lea ecx, [ebp - 0x30]
mov eax, dword [eax]
mov esi, dword [eax - 8]
push esi
push ebx
call fcn.0041a6a7
mov ecx, eax
call fcn.004191a9
add esi, esi
push esi
push eax
push edi
call fcn.004512b0
add esp, 0xc
lea ecx, [ebp - 0x30]
push 0xffffffffffffffff
push ebx
call fcn.0041a6a7
mov ecx, eax
call fcn.0041920f
add edi, 2
add edi, esi
xor eax, eax
mov word [edi], ax
inc ebx
cmp ebx, dword [ebp - 0x2c]
jl 0x42c778
push dword [ebp - 0x1c]
xor eax, eax
mov word [edi + 2], ax
mov edi, dword [ebp - 0x20]
push edi
push 7
push eax
mov eax, dword [ebp - 0x24]
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x42c833
cmp esi, 2
je 0x42c833
push edi
call fcn.00435690
pop ecx
test esi, esi
jle 0x42c81d
movzx esi, si
or esi, 0x80070000
push esi
lea ecx, [ebp - 0x24]
call fcn.00418994
push 0x45c73c
mov eax, ecx
push eax
call fcn.0043866a
push edi
call fcn.00435690
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00419240
lea ecx, [ebp - 0x30]
call fcn.0041abe1
call fcn.00450a75
ret 8