joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be6e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4be825
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4be80f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4be745
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x4be80f
cmp dword [ebp - 0x14], 0
jne 0x4be75c
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405e0c
mov bl, 1
jmp 0x4be80f
cmp dword [ebp - 0x14], 0x70000000
jb 0x4be76a
call fcn.0041ea50
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00405f48
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00406894
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x4be70e
test eax, eax
jne 0x4be80f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4be7b8
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x4be80f
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x4be7c0
dec esi
test esi, esi
je 0x4be7d4
lea eax, [ebp - 4]
call fcn.004051ec
cmp word [eax + esi*2 - 2], 0
je 0x4be7bf
cmp dword [ebp - 0x10], 7
jne 0x4be7df
test esi, esi
je 0x4be7df
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00406198
cmp dword [ebp - 0x10], 7
jne 0x4be802
test esi, esi
je 0x4be802
lea eax, [ebp - 4]
call fcn.00406894
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405e0c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be82c
lea eax, [ebp - 4]
call fcn.00405dfc
ret
Function at 0x4be8a4
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x58c20c]
cmp dword [eax], 2
je 0x4be8c1
mov byte [ebp - 1], 1
jmp 0x4bea8f
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x58a728
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4bea8f
xor eax, eax
push ebp
push 0x4bea88
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.KERNEL32.DLL_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x4be923
push 0x4bea9c
push 0x4beac8
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.00408f68
mov ebx, eax
test ebx, ebx
je 0x4be94a
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x4bea71
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x4bea71
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4be99b
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3f0
je 0x4be97c
call fcn.004048bc
jmp 0x4bea8f
lea eax, [ebp - 0x10]
push eax
push 8
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4be99b
call fcn.004048bc
jmp 0x4bea8f
xor eax, eax
push ebp
push 0x4bea6a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4be9de
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x7a
je 0x4be9de
call fcn.004048bc
call fcn.004048bc
jmp 0x4bea8f
mov eax, dword [ebp - 0x14]
call fcn.00403038
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4bea10
call fcn.004048bc
call fcn.004048bc
jmp 0x4bea8f
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x4bea4b
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4bea47
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x4bea47
mov byte [ebp - 1], 1
jmp 0x4bea4b
inc ebx
dec esi
jne 0x4bea1d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bea71
mov eax, dword [ebp - 0x18]
call fcn.00403054
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bea8f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf25c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004bf210
test al, al
jne 0x4bf27d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4bf2cb
xor eax, eax
push ebp
push 0x4bf2bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00405e98
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf2c2
lea eax, [ebp - 0xc]
call fcn.004bf24c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bf2d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004bf210
test al, al
jne 0x4bf2f8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4bf35e
xor eax, eax
push ebp
push 0x4bf34e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.KERNEL32.DLL_CreateProcessW
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf355
lea eax, [ebp - 0xc]
call fcn.004bf24c
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4bf36c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004bf210
test al, al
jne 0x4bf38d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4bf3d9
xor eax, eax
push ebp
push 0x4bf3c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405e98
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf3d0
lea eax, [ebp - 0xc]
call fcn.004bf24c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bf5a4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004bf210
test al, al
jne 0x4bf5c5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4bf611
xor eax, eax
push ebp
push 0x4bf601
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405e98
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf608
lea eax, [ebp - 0xc]
call fcn.004bf24c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf61c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004bf210
test al, al
jne 0x4bf640
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4bf68d
xor eax, eax
push ebp
push 0x4bf67d
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.00405e98
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf684
lea eax, [ebp - 0xc]
call fcn.004bf24c
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bf924
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4bf9f4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004be3d8
mov edx, dword [ebp - 8]
mov ecx, 0x4bfa10
xor eax, eax
call fcn.004bf818
push 0
mov eax, dword [ebp - 4]
call fcn.00405e98
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
test eax, eax
jne 0x4bf9cf
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x4bf940
push dword [ebp - 4]
push 0x4bfa28
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.004192ac
push dword [ebp - 0x10]
push 0x4bfa28
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004bec08
push dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.004063d4
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4170ec]
call fcn.0041ea5c
call fcn.004047c8
jmp 0x4bf940
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf9fb
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405e04
ret
Function at 0x4c00f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00405df4
xor eax, eax
push ebp
push 0x4c01d4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x4c0137
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.004bd854
cmp dword [ebp + 0x18], 0
jne 0x4c0137
lea eax, [ebp + 0x18]
call fcn.004be304
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.004036bc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x4c0162
mov eax, ebx
call fcn.00405e98
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00405e98
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00405e98
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00405e98
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4c01a4
call sub.KERNEL32.DLL_GetLastError
mov dword [esi], eax
jmp 0x4c01be
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x4c01be
push esi
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ebp + 0x14]
call fcn.004bfd90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c01db
lea eax, [ebp + 0x18]
call fcn.00405dfc
ret

Function at 0x4c01e8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x4c0216
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040601c
jmp 0x4c021f
mov eax, ebx
xor edx, edx
call fcn.00405e0c
add esp, 0x24
pop ebx
ret

Function at 0x4c0224
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4c0255
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040601c
jmp 0x4c025e
mov eax, ebx
xor edx, edx
call fcn.00405e0c
add esp, 0x208
pop ebx
ret
Function at 0x4c0a88
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c0b2a
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x10]
lea edx, [ebp - 9]
call fcn.004c08d4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e60
push 0
push 2
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405e98
mov ecx, eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [ebp - 9]
call fcn.004be87c
test eax, eax
jne 0x4c0b0d
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405e60
mov eax, dword [ebp - 8]
call fcn.00405e98
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x4c0b0f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0b31
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405e04
ret

Function at 0x4c0c08
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c0d35
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xd]
call fcn.004c08d4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e60
push 0
push 0
push 0
push 3
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405e98
mov ecx, eax
mov edx, dword [ebp - 0x14]
movzx eax, byte [ebp - 0xd]
call fcn.004be844
test eax, eax
jne 0x4c0d18
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405e60
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
call fcn.00405e60
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405e98
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4c0cb2
cmp dword [ebp - 0x1c], 2
jne 0x4c0cb2
mov esi, 2
jmp 0x4c0cb7
mov esi, 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4c0cd4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4c0cd4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004051dc
mov ebx, eax
test ebx, ebx
je 0x4c0cdf
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405e98
push eax
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.00405e98
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x4c0d0b
mov bl, 1
jmp 0x4c0d0d
xor ebx, ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x4c0d1a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0d3c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405e04
ret
Function at 0x4c0d48
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c0e40
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xd]
call fcn.004c08d4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e60
push 0
push 0
push 0
push 2
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405e98
mov ecx, eax
mov edx, dword [ebp - 0x14]
movzx eax, byte [ebp - 0xd]
call fcn.004be844
test eax, eax
jne 0x4c0e23
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405e60
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
call fcn.00405e60
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4c0dde
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4c0dde
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004051dc
mov ebx, eax
test ebx, ebx
je 0x4c0de9
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405e98
push eax
push 2
push 0
mov eax, dword [ebp - 8]
call fcn.00405e98
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x4c0e16
mov bl, 1
jmp 0x4c0e18
xor ebx, ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x4c0e25
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0e47
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405e04
ret
Function at 0x4c0e54
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c0fb0
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xd]
call fcn.004c08d4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e60
push 0
push 0
push 0
push 2
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405e98
mov ecx, eax
mov edx, dword [ebp - 0x14]
movzx eax, byte [ebp - 0xd]
call fcn.004be844
test eax, eax
jne 0x4c0f93
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405e60
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
call fcn.00405e60
cmp dword [ebp - 0xc], 0
je 0x4c0f31
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4c0ef6
mov eax, ebx
sub eax, 0xa
cmp word [eax], 2
je 0x4c0ef6
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004051dc
mov ebx, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4c0f13
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4c0f13
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004051dc
test eax, eax
je 0x4c0f1c
sub eax, 4
mov eax, dword [eax]
cmp word [ebx + eax*2 - 2], 0
je 0x4c0f31
lea eax, [ebp - 0xc]
mov edx, 0x4c0fd0
call fcn.00406230
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4c0f4e
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4c0f4e
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004051dc
mov ebx, eax
test ebx, ebx
je 0x4c0f59
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405e98
push eax
push 7
push 0
mov eax, dword [ebp - 8]
call fcn.00405e98
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x4c0f86
mov bl, 1
jmp 0x4c0f88
xor ebx, ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x4c0f95
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0fb7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405e04
ret
Function at 0x4c0fd4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c108d
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x10]
lea edx, [ebp - 9]
call fcn.004c08d4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e60
push 0
push 0
push 0
push 2
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405e98
mov ecx, eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [ebp - 9]
call fcn.004be844
test eax, eax
jne 0x4c1070
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405e60
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00405e98
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x4c1063
mov bl, 1
jmp 0x4c1065
xor ebx, ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x4c1072
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1094
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405e04
ret

Function at 0x4c10a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c11a4
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xd]
call fcn.004c08d4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e60
push 0
push 0
push 0
push 2
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405e98
mov ecx, eax
mov edx, dword [ebp - 0x14]
movzx eax, byte [ebp - 0xd]
call fcn.004be844
test eax, eax
jne 0x4c117f
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405e60
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
mov ecx, 0
call fcn.00406060
lea eax, [ebp - 0xc]
call fcn.00405838
mov esi, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4c1147
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4c1147
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.0040520c
mov ebx, eax
test ebx, ebx
je 0x4c1152
sub ebx, 4
mov ebx, dword [ebx]
push ebx
push esi
push 3
push 0
mov eax, dword [ebp - 8]
call fcn.00405e98
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x4c1172
mov bl, 1
jmp 0x4c1174
xor ebx, ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x4c1181
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c11ab
lea eax, [ebp - 0xc]
call fcn.00404ff0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405e04
ret