joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed10bb4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [section..data]
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x628]
push eax
xor esi, esi
cmp dword [0x4edd01d8], esi
mov edi, ecx
push 1
mov dword [ebp - 0x630], edi
push esi
je 0x4ed10bf8
push dword [0x4edd0a1c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x4ed10c09
push dword [0x4edd2dc8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x4ed10dd0
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x62c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x628]
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x634], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, esi
mov dword [ebp - 0x624], eax
je 0x4ed10c56
mov eax, dword [edi + 4]
shl eax, 3
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x624], esi
push esi
push 0x4ed10de0
mov ecx, edi
call fcn.4ed10a74
cmp dword [ebp - 0x62c], esi
jbe 0x4ed10d94
push ebx
mov ebx, 0x104
mov edi, 0x103
cmp dword [ebp - 0x624], edi
je 0x4ed10d8d
cmp dword [0x4edd01d8], esi
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x644], 0x208
je 0x4ed10ce2
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x638]
push eax
push esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x620]
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x4ed10d18
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x638]
push eax
push esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, edi
mov dword [ebp - 0x624], eax
je 0x4ed10d8d
cmp eax, esi
jne 0x4ed10d75
cmp dword [0x4edd01d8], esi
jne 0x4ed10d62
xor eax, eax
push ebx
mov ecx, 0x82
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x640]
add dword [ebp - 0x634], eax
mov ecx, dword [ebp - 0x630]
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ed10a74
inc dword [ebp - 0x620]
mov eax, dword [ebp - 0x620]
cmp eax, dword [ebp - 0x62c]
jb 0x4ed10c75
mov edi, dword [ebp - 0x630]
pop ebx
cmp dword [edi], esi
je 0x4ed10dc4
cmp dword [ebp + 8], esi
je 0x4ed10dbd
push dword [ebp - 0x62c]
push dword [ebp - 0x634]
push dword [ebp - 0x628]
call fcn.4ec77bd2
mov ecx, dword [edi + 0xc]
push eax
call fcn.4ecff371
mov dword [edi + 0x14], 1
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.4ecfd994
leave
ret 4
Function at 0x4ed11873
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [section..data]
push ebx
push edi
push 8
mov dword [ebp - 4], eax
mov edi, ecx
call fcn.4ec52209
xor ebx, ebx
cmp eax, ebx
mov dword [edi + 4], eax
je 0x4ed11a69
mov dword [eax], ebx
mov eax, dword [edi + 4]
push esi
mov dword [eax + 4], ebx
xor esi, esi
mov al, 0x45
mov byte [ebp + esi - 0x110], al
mov al, byte [esi + 0x4ed11a79]
inc esi
test al, al
jne 0x4ed118ab
call dword [sym.imp.KERNEL32.dll_GetACP]
test eax, eax
jbe 0x4ed118e9
xor edx, edx
push 0xa
pop ecx
div ecx
add dl, 0x30
mov byte [ebp + ebx - 0xc], dl
inc ebx
cmp ebx, 5
jge 0x4ed118e9
jmp 0x4ed118c3
mov al, byte [ebp + ebx - 0xc]
mov byte [ebp + esi - 0x110], al
inc esi
dec ebx
jns 0x4ed118dd
lea ecx, [ebp - 0x628]
push ecx
xor eax, eax
push 9
push eax
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x110]
push eax
push 0x80000001
mov byte [ebp + esi - 0x110], 0
mov dword [ebp - 0x630], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ed11a53
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x110]
push eax
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x62c]
mov esi, 0x104
push dword [ebp - 0x628]
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x638], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x4ed11a43
push esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ecff6cb
test eax, eax
je 0x4ed11930
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.4ecff6cb
test eax, eax
je 0x4ed11930
cmp dword [ebp - 0x630], ebx
je 0x4ed119ea
push 0x4ece1c50
lea eax, [ebp - 0x41c]
push eax
call fcn.4ec6260d
test eax, eax
jne 0x4ed119ea
lea eax, [ebp - 0x624]
push eax
mov ecx, edi
mov dword [ebp - 0x630], ebx
call fcn.4ed113fa
cmp eax, ebx
je 0x4ed11a43
mov ecx, dword [edi + 4]
mov dword [ecx], eax
jmp 0x4ed11a43
mov eax, dword [0x4edd0950]
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x41c]
push eax
call fcn.4ec7d890
mov ebx, eax
test ebx, ebx
je 0x4ed11a43
lea eax, [ebp - 0x624]
push eax
mov ecx, edi
call fcn.4ed113fa
mov esi, eax
test esi, esi
je 0x4ed11a43
push 0xc
call fcn.4ec52209
test eax, eax
je 0x4ed11a43
mov dword [eax], ebx
mov dword [eax + 4], esi
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x4ed11a3a
mov dword [ecx + 4], eax
and dword [eax + 8], edx
jmp 0x4ed11a43
mov dword [eax + 8], edx
mov ecx, dword [edi + 4]
mov dword [ecx + 4], eax
inc dword [ebp - 0x62c]
cmp dword [ebp - 0xc], 0
je 0x4ed11930
cmp dword [ebp - 0x628], 0
pop esi
je 0x4ed11a69
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.4ecfd994
leave
ret
Function at 0x4ed11b9a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
push ebx
push esi
mov esi, dword [0x4edd0e64]
mov dword [ebp - 4], eax
xor eax, eax
inc eax
xor ebx, ebx
add esi, 0x20
cmp dword [esi], 0xbfbfbfbf
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x21c], ebx
jne 0x4ed11c22
lea ecx, [ebp - 0x214]
push ecx
push eax
push ebx
push dword [0x4edd2dc8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ed11c22
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x210], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x4ed11c30
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.4ecfd994
leave
ret
mov eax, dword [esi + 4]
add esi, 8
cmp dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x220], esi
jbe 0x4ed11cf7
push edi
mov eax, 0x104
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x234], ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x4ed11cf0
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x210], eax
jae 0x4ed11cf0
mov eax, dword [ebp - 0x224]
mov esi, dword [ebp - 0x220]
mov ecx, eax
lea edi, [ebp - 0x108]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4ed11cf0
add dword [ebp - 0x220], eax
add dword [ebp - 0x210], eax
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x22c]
jae 0x4ed11cf6
jmp 0x4ed11c4f
mov dword [ebp - 0x218], ebx
pop edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x218], ebx
je 0x4ed11c22
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x210], eax
jne 0x4ed11c22
xor eax, eax
inc eax
jmp 0x4ed11c24
Function at 0x4ed11dea
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [section..data]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [0x4edd02cc], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
je 0x4ed11e69
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x218], ecx
lea ecx, [ebp - 0x218]
push ecx
push edi
lea ecx, [ebp - 0x21c]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4ed11ef3
cmp dword [ebp - 0x21c], 1
jne 0x4ed11ef0
mov eax, dword [ebp - 0x218]
shr eax, 1
je 0x4ed11ef0
cmp word [edi + eax*2 - 2], bx
jne 0x4ed11ef0
xor eax, eax
jmp 0x4ed11ef3
push eax
lea ecx, [ebp - 0x214]
call fcn.4ec8681d
cmp dword [ebp - 0x214], 0x55464131
jne 0x4ed11ef0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x104
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x4ed11ef3
cmp dword [ebp - 0x21c], 1
jne 0x4ed11ef0
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0x4ed11ef0
cmp byte [ebp + eax - 0x109], bl
jne 0x4ed11ef0
lea ecx, [eax + eax]
cmp ecx, dword [ebp + 0x14]
ja 0x4ed11ef0
push eax
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.4ecff6cb
neg eax
sbb eax, eax
and eax, 0xfffffff3
add eax, 0xd
jmp 0x4ed11ef3
push 0xd
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ecfd994
leave
ret 0x10
Function at 0x4ed1fbe7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [ebp + 0x18]
and al, 2
sub al, 2
neg al
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sbb eax, eax
inc eax
xor ebx, ebx
cmp esi, ebx
mov edi, eax
je 0x4ed1fc14
neg eax
sbb eax, eax
and eax, 0x16
add eax, esi
jmp 0x4ed1fc16
xor eax, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.4ed1fa7b
cmp eax, ebx
mov dword [ebp + 0x18], eax
je 0x4ed1fd29
cmp edi, ebx
je 0x4ed1fd29
add dword [ebp + 0x18], 0x16
cmp esi, ebx
je 0x4ed1fd29
lea eax, [ebp - 0x6c]
mov byte [esi], 0xd7
mov byte [esi + 1], 0xcd
mov byte [esi + 2], 0xc6
mov byte [esi + 3], 0x9a
push eax
mov byte [esi + 4], bl
mov byte [esi + 5], bl
push 0x6c
push dword [ebp + 8]
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
call sub.GDI32.dll_GetEnhMetaFileHeader
test eax, eax
je 0x4ed1fceb
fild dword [ebp - 0x24]
fidiv dword [ebp - 0x1c]
fmul dword [0x4eca085c]
fiadd dword [ebp - 0x20]
fidiv dword [ebp - 0x18]
fmul dword [0x4eca085c]
fmul dword [0x4ec51678]
fild dword [ebp - 0x54]
fmul st(1)
call fcn.4ec5bb24
fild dword [ebp - 0x50]
mov byte [esi + 6], al
mov byte [esi + 7], ah
fmul st(1)
call fcn.4ec5bb24
fild dword [ebp - 0x4c]
mov byte [esi + 8], al
mov byte [esi + 9], ah
fmul st(1)
call fcn.4ec5bb24
fild dword [ebp - 0x48]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], ah
fmul st(1)
call fcn.4ec5bb24
fmul dword [0x4eca0e90]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], ah
call fcn.4ec5bb24
mov byte [esi + 0xe], al
mov byte [esi + 0xf], ah
jmp 0x4ed1fd0e
mov byte [esi + 6], bl
mov byte [esi + 7], bl
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], 0xd0
mov byte [esi + 0xb], 7
mov byte [esi + 0xc], 0xd0
mov byte [esi + 0xd], 7
mov byte [esi + 0xe], 0x60
mov byte [esi + 0xf], bl
lea edx, [esi + 0x14]
cmp esi, edx
mov ecx, esi
mov dword [ebp + 8], ebx
mov ax, bx
jae 0x4ed1fd26
xor ax, word [ecx]
inc ecx
inc ecx
cmp ecx, edx
jb 0x4ed1fd1d
mov word [ecx], ax
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4ed296db
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [section..data]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
push 9
xor edi, edi
push edi
push 0x4ed29848
push 0x80000002
mov dword [0x4edd0930], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ed2982c
call fcn.4ec81232
cmp eax, edi
je 0x4ed29726
mov eax, dword [eax + 8]
cmp eax, edi
mov dword [ebp - 0x68], eax
jne 0x4ed29734
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ed2982c
push ebx
mov dword [ebp - 0x60], edi
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x60]
mov dword [ebp - 0x5c], 8
push dword [ebp - 0x58]
mov dword [ebp - 0x64], 0x20
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0x6c], eax
jne 0x4ed29815
cmp dword [ebp - 0x5c], 6
mov esi, dword [ebp - 0xa]
mov word [ebp - 0xa], di
je 0x4ed29799
cmp dword [ebp - 0x5c], 7
jne 0x4ed29815
cmp word [ebp - 8], 0x30
jb 0x4ed29815
cmp word [ebp - 8], 0x36
ja 0x4ed29815
cmp si, 0x31
jb 0x4ed29815
cmp si, 0x39
ja 0x4ed29815
push 0x4ed29838
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4ed29815
cmp dword [ebp - 0x5c], 7
jne 0x4ed297d1
movzx ecx, word [ebp - 8]
movzx eax, si
lea eax, [eax + eax*4]
lea esi, [ecx + eax*2 - 0x211]
jmp 0x4ed297d7
movzx esi, si
sub esi, 0x31
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x54]
push eax
call fcn.4ec7d890
mov ebx, eax
cmp ebx, edi
je 0x4ed29815
cmp dword [0x4edd0930], edi
jne 0x4ed2980d
push 0x40
call fcn.4ec52209
mov edi, eax
test edi, edi
mov dword [0x4edd0930], edi
je 0x4ed29821
push 0x10
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
xor edi, edi
mov eax, dword [0x4edd0930]
mov dword [eax + esi*4], ebx
inc dword [ebp - 0x60]
cmp dword [ebp - 0x6c], edi
je 0x4ed29739
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.4ecfd994
leave
ret

Function at 0x4ed2a288
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ed2a2b5
xor eax, eax
jmp 0x4ed2a2df
push edi
mov edi, dword [ebp + 0x10]
push esi
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ed2a2d5
cmp edi, dword [ebp + 8]
jne 0x4ed2a2d5
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4ed3939a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
mov ebx, dword [0x4edd0924]
mov dword [ebp - 4], ebx
je 0x4ed3946c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push edi
mov edi, 0x4ece446c
push edi
push 0x4ece4460
push ebx
call esi
test eax, eax
je 0x4ed3946a
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
call ebx
test eax, eax
je 0x4ed3946a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4ed3946a
cmp dword [eax], 0x2e435269
jne 0x4ed3946a
cmp dword [eax + 4], 0
jne 0x4ed3946a
push edi
lea ecx, [eax + 0x10]
push 0x4ed39480
push dword [ebp - 4]
mov dword [0x4edda058], ecx
mov eax, dword [eax + 0xc]
mov dword [0x4edda064], eax
call esi
test eax, eax
je 0x4ed3946a
push eax
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4ed3946a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4ed39471
cmp dword [eax], 0x2e435269
jne 0x4ed39471
cmp dword [eax + 4], 1
jne 0x4ed39471
lea ecx, [eax + 0x10]
mov dword [0x4edda05c], ecx
mov eax, dword [eax + 0xc]
add eax, ecx
mov dword [0x4edda060], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x4ed439ba
mov dword [eax + 4], 0x4ed39334
mov dword [eax + 8], 0x4ed39370
pop edi
pop esi
pop ebx
leave
ret 4
mov dword [0x4edda05c], 0x4edda068
jmp 0x4ed3946a
Function at 0x4ed43355
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
movzx esi, byte [eax]
lea ecx, [eax + 1]
movzx eax, byte [ecx]
xor edx, edx
shl esi, 8
push edi
mov edi, dword [0x4edda064]
inc edx
add esi, eax
cmp edi, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
jb 0x4ed43502
mov eax, dword [0x4edda058]
push ebx
mov ecx, dword [ebp - 8]
add ecx, edi
shr ecx, 1
movzx edx, byte [eax + ecx*8 - 8]
movzx ebx, byte [eax + ecx*8 - 7]
shl edx, 8
add edx, ebx
cmp edx, esi
jae 0x4ed433b1
lea edx, [ecx + 1]
mov dword [ebp - 8], edx
jmp 0x4ed433b6
jbe 0x4ed433bb
lea edi, [ecx - 1]
cmp edi, dword [ebp - 8]
jae 0x4ed4338f
cmp edi, dword [ebp - 8]
jb 0x4ed43501
mov ebx, dword [ebp - 0xc]
lea ecx, [eax + ecx*8]
mov esi, dword [ecx - 4]
mov edi, dword [ecx + 4]
add esi, eax
add edi, eax
mov al, byte [ebx]
mov dword [ebp - 8], 0xffff
mov dword [ebp - 0x10], 1
mov byte [ebp - 1], al
jmp 0x4ed434f9
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jb 0x4ed43466
jmp 0x4ed43501
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
and al, 0x7f
movzx ax, al
inc ecx
imul eax, ecx
inc dword [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, byte [ebp - 1]
inc ebx
cmp dword [eax*4 + 0x4edd3bc8], 2
mov al, byte [ebx]
mov byte [ebp - 1], al
jl 0x4ed43466
test al, al
je 0x4ed4346c
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0x4ed4346c
movzx eax, byte [ebp - 1]
mov eax, dword [eax*4 + 0x4edd3bc8]
cdq
push 2
pop ecx
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jne 0x4ed43466
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 0xfffffffe
cmp ebx, eax
ja 0x4ed4346c
cmp byte [ebx + 1], 0xec
je 0x4ed43466
cmp ebx, eax
je 0x4ed4346c
cmp byte [ebx + 2], 0xec
jne 0x4ed4346c
cmp byte [ebp - 1], 0x7f
ja 0x4ed433f8
cmp esi, edi
jae 0x4ed434ec
mov ecx, dword [ebp - 0x10]
push 2
pop edx
mov ax, word [esi]
cmp cx, ax
je 0x4ed4349b
jb 0x4ed434ec
cmp esi, edi
jae 0x4ed434ec
cmp al, 2
jne 0x4ed4348c
add esi, edx
jmp 0x4ed43495
add esi, edx
movzx eax, word [esi]
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jae 0x4ed434ec
jmp 0x4ed43476
add esi, edx
cmp cx, dx
jne 0x4ed434ad
push edx
push dword [ebp + 0xc]
call fcn.4ed426b6
jmp 0x4ed434ec
xor eax, eax
mov ax, word [esi]
add esi, edx
test ax, ax
mov dword [ebp - 0xc], eax
jbe 0x4ed434ec
mov ax, word [esi]
cmp word [ebp - 8], ax
je 0x4ed434d9
jbe 0x4ed434e5
add dword [ebp - 0xc], 0xffff
inc esi
inc esi
cmp word [ebp - 0xc], 0
jbe 0x4ed434ec
jmp 0x4ed434bc
movzx eax, cx
push eax
push dword [ebp + 0xc]
call fcn.4ed426b6
movzx eax, word [ebp - 0xc]
lea esi, [esi + eax*2]
cmp byte [ebp - 1], 0x80
jb 0x4ed43501
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
ja 0x4ed43501
cmp esi, edi
jb 0x4ed433ec
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x4ed49cb9
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov ecx, dword [0x4edd0934]
mov eax, dword [section..data]
push edi
xor edi, edi
cmp ecx, edi
mov dword [ebp - 4], eax
jne 0x4ed49d0d
push 0x48
call fcn.4ec52209
cmp eax, edi
je 0x4ed49cec
mov ecx, eax
call fcn.4ed49b59
mov ecx, eax
jmp 0x4ed49cee
xor ecx, ecx
cmp ecx, edi
mov dword [0x4edd0934], ecx
je 0x4ed49d03
cmp dword [ecx], edi
je 0x4ed49d0d
push 1
call fcn.4ed03f67
mov dword [0x4edd0934], edi
xor eax, eax
jmp 0x4ed49d8c
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx esi, bx
push esi
call fcn.4ed2918f
movzx eax, byte [eax]
sub eax, edi
je 0x4ed49d40
dec eax
je 0x4ed49d2c
sub eax, 0xfe
jmp 0x4ed49d88
mov edi, 0x3ff
and bx, di
cmp bx, 0x78
jbe 0x4ed49e8d
jmp 0x4ed49d88
push 1
push esi
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4ed49d74
cmp dword [0x4edd01d8], edi
je 0x4ed49d99
push 0x14
lea eax, [ebp - 0x2c]
push eax
push 0x13
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jbe 0x4ed49d74
cmp word [ebp - 0x2a], 0x31
jne 0x4ed49e67
mov ecx, dword [0x4edd0934]
lea eax, [ebp - 0x2d]
push eax
push esi
mov byte [ebp - 0x2d], 0xff
call fcn.4ed49bf9
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.4ecfd994
leave
ret 4
mov eax, 0xc01
cmp esi, eax
ja 0x4ed49e18
je 0x4ed49e67
cmp esi, 0x447
ja 0x4ed49de4
cmp esi, 0x446
jae 0x4ed49e67
mov eax, esi
sub eax, 0x401
je 0x4ed49e67
sub eax, 0x1d
je 0x4ed49e67
dec eax
dec eax
je 0x4ed49e67
sub eax, 9
jne 0x4ed49d74
jmp 0x4ed49e67
cmp esi, 0x44a
jb 0x4ed49d74
cmp esi, 0x44b
jbe 0x4ed49e67
cmp esi, 0x44d
jbe 0x4ed49d74
cmp esi, 0x44f
jbe 0x4ed49e67
cmp esi, 0x457
je 0x4ed49e67
cmp esi, 0x801
jmp 0x4ed49ddd
mov eax, 0x3001
cmp esi, eax
ja 0x4ed49e43
je 0x4ed49e67
cmp esi, 0x2001
je 0x4ed49e67
cmp esi, 0x2401
je 0x4ed49e67
cmp esi, 0x2801
je 0x4ed49e67
cmp esi, 0x2c01
jmp 0x4ed49ddd
cmp esi, 0x3401
je 0x4ed49e67
cmp esi, 0x3801
je 0x4ed49e67
cmp esi, 0x3c01
je 0x4ed49e67
cmp esi, 0x4001
jne 0x4ed49d74
mov ecx, dword [0x4edd0934]
mov edi, 0x3ff
lea eax, [ebp - 0x2d]
and bx, di
cmp bx, 0x78
push eax
push esi
ja 0x4ed49d7f
mov byte [ebp - 0x2d], 1
call fcn.4ed49bf9
and esi, edi
mov esi, dword [esi*4 + 0x4ece5428]
lea eax, [esi + esi*4]
mov ax, word [eax*4 + 0x4ece1dc8]
neg ax
sbb eax, eax
and eax, esi
jmp 0x4ed49d8a
Function at 0x4ed50a42
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [section..data]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
cmp dword [0x4edd02cc], esi
lea ecx, [ebp - 0x114]
push ecx
push esi
push esi
lea ecx, [ebp - 0x10c]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], 0x104
push ecx
je 0x4ed50a8f
push ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4ed50ac0
lea ecx, [ebp - 0x108]
push ecx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
jne 0x4ed50ac0
push 0x104
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.4ecff6cb
neg eax
sbb eax, eax
and eax, 0xfffffff3
add eax, 0xd
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.4ecfd994
leave
ret 0xc

Function at 0x4ed50b4d
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
cmp dword [0x4edd02cc], 0
mov eax, dword [section..data]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push eax
je 0x4ed50b7a
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4ed50ba3
lea ecx, [ebp - 0x110]
call fcn.4ec8681d
cmp dword [ebp - 0x110], 0x55464131
jne 0x4ed50ba0
push dword [ebp - 0x10c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x4ed50ba3
push 0xd
pop eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ecfd994
leave
ret 8

Function at 0x4ed50bb5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
cmp dword [0x4edd02cc], 0
mov eax, dword [section..data]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
je 0x4ed50bf7
push esi
call fcn.4ec62683
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4ed50c54
push edi
lea ecx, [ebp - 0x21c]
call fcn.4ec8681d
push esi
lea ecx, [ebp - 0x110]
call fcn.4ec8681d
mov eax, 0x55464131
cmp dword [ebp - 0x21c], eax
jne 0x4ed50c51
cmp dword [ebp - 0x110], eax
jne 0x4ed50c51
mov eax, dword [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed50c2d
sub eax, edx
inc eax
push eax
push dword [ebp - 0x10c]
push 1
push 0
push dword [ebp - 0x218]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4ed50c54
push 0xd
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ecfd994
leave
ret 0xc