joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ef70
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x42efb3
mov eax, dword [ebp - 0x10c]
mov dword [0x611958], eax
mov eax, 0x61195c
lea edx, [ebp - 0x108]
mov ecx, 0x80
call fcn.0040aeec
mov eax, 0x611960
call fcn.0040a3ec
xor eax, eax
mov dword [0x611964], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x61181c], 0xa
jl 0x42f109
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x42f114
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x42f109
xor eax, eax
push ebp
push 0x42f102
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42f170
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42f062
cmp dword [ebp - 8], 2
jle 0x42f062
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42f035
adc edx, 0
mov eax, 0x611960
call fcn.0040afc4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x611960]
call fcn.0040ae50
push eax
push 0
push 0
push 0x42f170
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x42f0bc
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42f190
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42f0bc
cmp dword [ebp - 8], 2
jle 0x42f0bc
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42f091
adc edx, 0
mov eax, 0x611960
call fcn.0040afc4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x611960]
call fcn.0040ae50
push eax
push 0
push 0
push 0x42f190
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x611964
push 0
push 0
push 0x42f1a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x42f0e9
xor eax, eax
mov dword [0x611964], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f109
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x606710], 1
mov esp, ebp
pop ebp
ret
Function at 0x42f24c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42f326
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a824
lea eax, [ebp - 4]
call fcn.0040a944
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x42f30e
mov eax, ebx
call fcn.00406fcc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42f307
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x42f2ef
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42f338
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x42f2ef
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f30e
mov eax, dword [ebp - 0x10]
call fcn.00406fe8
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f32d
lea eax, [ebp - 4]
call fcn.0040a3ec
pop eax
jmp eax

Function at 0x4303f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a8d0
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410310
mov edi, eax
cmp edi, 0x104
jbe 0x43039f
mov eax, edi
add eax, eax
call fcn.00406fcc
mov esi, eax
jmp 0x4303a1
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410310
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4303da
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4303c4
mov eax, esp
cmp esi, eax
je 0x4303e7
mov eax, esi
call fcn.00406fe8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x430420
cmp bl, 0
je 0x43041c
cmp bl, 0x41
jl 0x430417
cmp bl, 0x5a
jg 0x430417
or bl, 0x20
xor al, bl
inc esi
jmp 0x4303fb
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x430360

Function at 0x430d38
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040aeec
add esp, 0x800
pop ebx
ret
Function at 0x431350
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.0040a3ec
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040ae50
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x431395
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040a584
jmp 0x4313ae
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040afc4
push ebx
mov eax, dword [esi]
call fcn.0040ae50
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x433690
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x4336aa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x4336a5
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4336af
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x43371d
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x433766
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x4336db
inc dword [ebp - 0xc]
jmp 0x4336f3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x4336f3
cmp dword [ebp - 0xc], 0
jle 0x4336f3
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x433715
xor eax, eax
jmp 0x433711
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x433710
mov eax, esi
jmp 0x433769
inc eax
cmp eax, ecx
jle 0x4336fd
inc esi
cmp esi, dword [ebp - 8]
jl 0x4336c7
jmp 0x433766
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x433766
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x43373e
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x433760
xor eax, eax
jmp 0x43375c
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x43375b
mov eax, esi
jmp 0x433769
inc eax
cmp eax, ecx
jle 0x433748
inc esi
cmp esi, dword [ebp - 8]
jl 0x433726
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x433978
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x433997
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x4339a7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x433ac9
test ebx, ebx
jl 0x433ac9
test esi, esi
jle 0x433ac9
mov eax, dword [ebp - 8]
call fcn.0040ae50
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040ae50
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x433a66
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x433ac9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x433a4b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x433a1a
inc dword [ebp - 0x14]
jmp 0x433a2a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x433a2a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x433a35
or eax, 0xffffffff
jmp 0x433a4b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x433a48
inc eax
jmp 0x433a4b
or eax, 0xffffffff
test eax, eax
jl 0x433a53
cmp esi, eax
jg 0x433a08
cmp esi, eax
jg 0x433a5e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x433acc
inc edx
dec dword [ebp - 0x1c]
jne 0x433a04
jmp 0x433ac9
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x433ac9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x433ab0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x433a8f
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x433a9a
or eax, 0xffffffff
jmp 0x433ab0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x433aad
inc eax
jmp 0x433ab0
or eax, 0xffffffff
test eax, eax
jl 0x433ab8
cmp esi, eax
jg 0x433a78
cmp esi, eax
jg 0x433ac3
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x433acc
inc edx
dec dword [ebp - 0x1c]
jne 0x433a74
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x443134
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x44313c
mov eax, edx
pop esi
pop ebx
ret
Function at 0x4527b8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4527cc
add esp, 0xfffffff0
call fcn.00408c30
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44c854]
call fcn.00470298
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x4517f4]
call fcn.00473068
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x4517f4]
call fcn.00473068
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x452821
call fcn.00408c88
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c2420
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4c2463
cmp byte [ebx + 0x11], 0
jne 0x4c2463
cmp byte [ebx + 0x24], 0
jne 0x4c2463
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4c247a
mov ecx, dword [0x60d274]
mov dl, 1
mov eax, dword [0x48d894]
call fcn.0042dc3c
call fcn.00409ae4
pop ebx
ret
mov ecx, dword [0x60d274]
mov dl, 1
mov eax, dword [0x48d894]
call fcn.0042dc3c
call fcn.00409ae4
pop ebx
ret

Function at 0x4c2de8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c2e36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004c22cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2e4f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c2e58
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004c22cc
dec esi
jne 0x4c2e7a
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4c5b50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x61490c
cmp dword [edi], 0
jne 0x4c5bcc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x614908]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x6073b4
mov ecx, 2
call fcn.004073d0
mov edx, 0x4c5b28
lea eax, [esi + 5]
call fcn.004c5b48
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004c5b48
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4c5ba1
mov dword [0x614908], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4df358
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4df36f
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4df35f
mov eax, ecx
pop ebx
ret

Function at 0x50b974
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x50b9d9
mov eax, dword [esp]
call fcn.0050bc28
test al, al
je 0x50b9d9
mov eax, dword [esp]
call fcn.0050ba34
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x50b9bc
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x50b9d9
cmp ax, 0x5a
ja 0x50b9d9
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x50dc48
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x50de07
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a824
mov eax, dword [ebp - 4]
call fcn.0050d594
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x50dc9a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b254
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0050e89c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x50dd7b
xor eax, eax
push ebp
push 0x50dd74
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0050d834
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0050de3c
test al, al
je 0x50dd50
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a584
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x50dd50
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040ae50
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050d794
test al, al
je 0x50dd4a
mov eax, dword [ebp - 8]
call fcn.0040ae50
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040aeb0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0050dc48
dec ebx
cmp ebx, 0xffffffff
jne 0x50dcf9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dd7b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0050d834
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x614968], 0
je 0x50ddbb
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0050d820
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050d794
mov ebx, eax
jmp 0x50dde2
mov eax, dword [ebp - 4]
call fcn.0040ae50
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0050d820
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050d794
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50de0e
lea eax, [ebp - 0x3c]
call fcn.0040a3ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a44c
pop eax
jmp eax
Function at 0x50e778
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0050d5ac
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040ae50
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.0050d794
test al, al
jne 0x50e7e0
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x60d16c]
mov dl, 1
mov eax, dword [0x50c378]
call fcn.0042dd10
call fcn.00409ae4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x50e7ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040ae50
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.0050d794
test al, al
jne 0x50e84d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x60d504]
mov dl, 1
mov eax, dword [0x50c378]
call fcn.0042dd10
call fcn.00409ae4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0050d5dc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50ee64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x50ef90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.0050d834
xor eax, eax
push ebp
push 0x50ef69
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050de3c
test al, al
je 0x50ef4b
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0050ed3c
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a584
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x50ef4b
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050d794
test al, al
je 0x50ef47
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040aeb0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0050ed3c
pop ecx
inc edi
dec ebx
jne 0x50eeef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ef70
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.0050d834
pop eax
jmp eax
Function at 0x50efa0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50f1f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0050d834
xor eax, eax
push ebp
push 0x50f1cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050de3c
test al, al
je 0x50f1ae
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a584
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x50f1ae
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050d794
test al, al
je 0x50f1a2
mov eax, dword [ebp - 4]
call fcn.0040ae50
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040aeb0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050e89c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50f1a2
xor eax, eax
push ebp
push 0x50f19b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0050d834
xor eax, eax
push ebp
push 0x50f17b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040ae50
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040aeb0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050d838
mov eax, dword [ebp - 4]
call fcn.0040ae50
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040aeb0
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050e89c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x50f156
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050ee64
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050efa0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f15d
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x50f02b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f1d3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0050d834
pop eax
jmp eax