joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405407
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4c6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 8]
dec eax
add esp, 0xc
mov dword [ebp - 0x114], 0x104
cmp eax, 4
ja case.default.0x405400
jmp dword [eax*4 + 0x405540]
mov eax, SysReAllocString
jmp 0x405428
mov eax, SysReAllocString
jmp 0x405428
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x405428
mov eax, SysStringLen
jmp 0x405428
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x405438
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x110]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054cb
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x40545c
lea eax, [ebp + 0x28]
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov edx, dword [ebp - 0x110]
lea ecx, [ebp - 0x10c]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054cb
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405498
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4054b3
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x4054df
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov eax, dword [ebp + 0x28]
push eax
jmp 0x405526
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x405510
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x40540e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4c6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 8]
dec eax
add esp, 0xc
mov dword [ebp - 0x114], 0x104
cmp eax, 4
ja case.default.0x405400
jmp dword [eax*4 + 0x405540]
mov eax, SysReAllocString
jmp 0x405428
mov eax, SysReAllocString
jmp 0x405428
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x405428
mov eax, SysStringLen
jmp 0x405428
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x405438
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x110]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054cb
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x40545c
lea eax, [ebp + 0x28]
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov edx, dword [ebp - 0x110]
lea ecx, [ebp - 0x10c]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054cb
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405498
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4054b3
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x4054df
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov eax, dword [ebp + 0x28]
push eax
jmp 0x405526
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x405510
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x405415
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4c6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 8]
dec eax
add esp, 0xc
mov dword [ebp - 0x114], 0x104
cmp eax, 4
ja case.default.0x405400
jmp dword [eax*4 + 0x405540]
mov eax, SysReAllocString
jmp 0x405428
mov eax, SysReAllocString
jmp 0x405428
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x405428
mov eax, SysStringLen
jmp 0x405428
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x405438
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x110]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054cb
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x40545c
lea eax, [ebp + 0x28]
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov edx, dword [ebp - 0x110]
lea ecx, [ebp - 0x10c]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054cb
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405498
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4054b3
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x4054df
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov eax, dword [ebp + 0x28]
push eax
jmp 0x405526
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x405510
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x40541c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4c6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 8]
dec eax
add esp, 0xc
mov dword [ebp - 0x114], 0x104
cmp eax, 4
ja case.default.0x405400
jmp dword [eax*4 + 0x405540]
mov eax, SysReAllocString
jmp 0x405428
mov eax, SysReAllocString
jmp 0x405428
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x405428
mov eax, SysStringLen
jmp 0x405428
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x405438
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x110]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054cb
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x40545c
lea eax, [ebp + 0x28]
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov edx, dword [ebp - 0x110]
lea ecx, [ebp - 0x10c]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054cb
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405498
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4054b3
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x4054df
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov eax, dword [ebp + 0x28]
push eax
jmp 0x405526
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x405510
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x405423
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4c6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 8]
dec eax
add esp, 0xc
mov dword [ebp - 0x114], 0x104
cmp eax, 4
ja case.default.0x405400
jmp dword [eax*4 + 0x405540]
mov eax, SysReAllocString
jmp 0x405428
mov eax, SysReAllocString
jmp 0x405428
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x405428
mov eax, SysStringLen
jmp 0x405428
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x405438
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x110]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054cb
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x40545c
lea eax, [ebp + 0x28]
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
mov edx, dword [ebp - 0x110]
lea ecx, [ebp - 0x10c]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054cb
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405498
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4054b3
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x4054df
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov eax, dword [ebp + 0x28]
push eax
jmp 0x405526
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x405510
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x40552b
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00449013
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x405820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
dec eax
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 4
cmp eax, 4
ja case.default.0x405845
jmp dword [eax*4 + 0x4059b4]
mov eax, SysReAllocString
jmp 0x40586d
mov eax, SysReAllocString
jmp 0x40586d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x40586d
mov eax, SysStringLen
jmp 0x40586d
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x40587d
lea ecx, [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40593a
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x4058a2
lea eax, [ebp + 0x28]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4058fc
mov eax, dword [ebp - 4]
lea ecx, [ebp + 0xc]
cmp eax, dword [ebp + 0x44]
jne 0x4058e4
call fcn.00401fc0
lea ecx, [ebp + 0x28]
call fcn.00401fc0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x40
call fcn.00401fc0
lea ecx, [ebp + 0x28]
call fcn.00401fc0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405910
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x40594e
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x40598d
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov eax, dword [ebp + 0x28]
push eax
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
Function at 0x40584c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
dec eax
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 4
cmp eax, 4
ja case.default.0x405845
jmp dword [eax*4 + 0x4059b4]
mov eax, SysReAllocString
jmp 0x40586d
mov eax, SysReAllocString
jmp 0x40586d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x40586d
mov eax, SysStringLen
jmp 0x40586d
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x40587d
lea ecx, [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40593a
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x4058a2
lea eax, [ebp + 0x28]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4058fc
mov eax, dword [ebp - 4]
lea ecx, [ebp + 0xc]
cmp eax, dword [ebp + 0x44]
jne 0x4058e4
call fcn.00401fc0
lea ecx, [ebp + 0x28]
call fcn.00401fc0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x40
call fcn.00401fc0
lea ecx, [ebp + 0x28]
call fcn.00401fc0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405910
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x40594e
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x40598d
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov eax, dword [ebp + 0x28]
push eax
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
Function at 0x405853
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
dec eax
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 4
cmp eax, 4
ja case.default.0x405845
jmp dword [eax*4 + 0x4059b4]
mov eax, SysReAllocString
jmp 0x40586d
mov eax, SysReAllocString
jmp 0x40586d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x40586d
mov eax, SysStringLen
jmp 0x40586d
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x40587d
lea ecx, [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40593a
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x4058a2
lea eax, [ebp + 0x28]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4058fc
mov eax, dword [ebp - 4]
lea ecx, [ebp + 0xc]
cmp eax, dword [ebp + 0x44]
jne 0x4058e4
call fcn.00401fc0
lea ecx, [ebp + 0x28]
call fcn.00401fc0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x40
call fcn.00401fc0
lea ecx, [ebp + 0x28]
call fcn.00401fc0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405910
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x40594e
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x40598d
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov eax, dword [ebp + 0x28]
push eax
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
Function at 0x40585a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
dec eax
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 4
cmp eax, 4
ja case.default.0x405845
jmp dword [eax*4 + 0x4059b4]
mov eax, SysReAllocString
jmp 0x40586d
mov eax, SysReAllocString
jmp 0x40586d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x40586d
mov eax, SysStringLen
jmp 0x40586d
mov eax, SysStringLen
mov ecx, dword [ebp + 0xc]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jae 0x40587d
lea ecx, [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40593a
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x4058a2
lea eax, [ebp + 0x28]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4058fc
mov eax, dword [ebp - 4]
lea ecx, [ebp + 0xc]
cmp eax, dword [ebp + 0x44]
jne 0x4058e4
call fcn.00401fc0
lea ecx, [ebp + 0x28]
call fcn.00401fc0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x40
call fcn.00401fc0
lea ecx, [ebp + 0x28]
call fcn.00401fc0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x405910
mov ecx, dword [ebp + 0xc]
push ecx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov edx, dword [ebp + 0x28]
push edx
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp dword [ebp + 0x20], edi
jb 0x40594e
mov eax, dword [ebp + 0xc]
push eax
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov ecx, dword [ebp + 0x28]
push ecx
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [ebp + 0x20], edi
jb 0x40598d
mov edx, dword [ebp + 0xc]
push edx
call esi
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x4059a8
mov eax, dword [ebp + 0x28]
push eax
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x40