joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a6bb
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x47688c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42a709
mov eax, dword [ebp - 4]
push eax
push 0x4768c8
call fcn.00452380
add esp, 8
jmp 0x42a76a
cmp dword [ebp + 8], 0
je 0x42a741
push str._nUpdating_Registry_to_always_BLOCK_new_EXE_COM_files_from_being_created._n_rAnd_to_always_BLOCK_existing_EXE_COM_files_from_being_created._n_rBlocking_will_occur_regardless_of_server_settings.
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x4769a8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42a760
push str.AlwaysDenyRenames
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
push str._nRemoving_option_to_always_BLOCK_EXE_COM_file_updates._n_rWill_now__default__to_server_settings.
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42a76f
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x476a50
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42a7bd
mov eax, dword [ebp - 4]
push eax
push 0x476a8c
call fcn.00452380
add esp, 8
jmp 0x42a81e
cmp dword [ebp + 8], 0
je 0x42a7f5
push str._n_rSofTrack:_Set_NM_1
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x476ac4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42a814
push str._n_rSofTrack:_Set_NM_0
call fcn.00452380
add esp, 4
push str.NoMetering
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42a823
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x476b0c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42a871
mov eax, dword [ebp - 4]
push eax
push 0x476b48
call fcn.00452380
add esp, 8
jmp 0x42a8d2
cmp dword [ebp + 8], 0
je 0x42a8a9
push str._n_rSofTrack:_Set_LS_1
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x476b80
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42a8c8
push str._n_rSofTrack:_Set_LS_0
call fcn.00452380
add esp, 4
push str.LotusSwitch
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42a8d7
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x476bc8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42a925
mov eax, dword [ebp - 4]
push eax
push 0x476c04
call fcn.00452380
add esp, 8
jmp 0x42a986
cmp dword [ebp + 8], 0
je 0x42a95d
push str._n_rSofTrack:_Set_SysferSwitch
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x476c44
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42a97c
push str._n_rSofTrack:_Set_Sysfer_Un_0
call fcn.00452380
add esp, 4
push str.SysferSwitch
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42a98b
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x476c98
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42a9d9
mov eax, dword [ebp - 4]
push eax
push 0x476cd4
call fcn.00452380
add esp, 8
jmp 0x42aa3a
cmp dword [ebp + 8], 0
je 0x42aa11
push str._n_rSofTrack:_Set_PowerWatch_:_Enabled
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x476d1c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42aa30
push str._n_rSofTrack:_Set_PowerWatch_:_Disabled
call fcn.00452380
add esp, 4
push str.PowerWatch
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42aa3f
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x476d74
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42aa8d
mov eax, dword [ebp - 4]
push eax
push 0x476db0
call fcn.00452380
add esp, 8
jmp 0x42aaee
cmp dword [ebp + 8], 0
je 0x42aac5
push str._n_rSofTrack:_Set_VMLPM_:_Enabled
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x476df0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42aae4
push str._n_rSofTrack:_Set_VMLPM_:_Disabled
call fcn.00452380
add esp, 4
push str.VMLPM
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42aaf3
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x476e2c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ab41
mov eax, dword [ebp - 4]
push eax
push 0x476e68
call fcn.00452380
add esp, 8
jmp 0x42aba2
cmp dword [ebp + 8], 0
je 0x42ab79
push str._nUpdating_Registry_to_always_Audit_Browser_Activity_regardless_of_SSA_setting
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x476ed8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42ab98
push str.AlwaysAuditBrowser
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
push str._nUpdating_Registry_to_Audit_Browser_Activity_as_set_per_SSA
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42aba7
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x476f64
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42abf5
mov eax, dword [ebp - 4]
push eax
push 0x476fa0
call fcn.00452380
add esp, 8
jmp 0x42ac56
cmp dword [ebp + 8], 0
je 0x42ac2d
push str._nUpdating_Registry_to_include_Bentley_Activation_code
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x476ff8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42ac4c
push str.IncludeBActivationCode
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
push str._nUpdating_Registry_to_include_Bentley_Activation_code_as_set_per_SSA
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ac5b
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x4770a0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42aca9
mov eax, dword [ebp - 4]
push eax
push 0x4770dc
call fcn.00452380
add esp, 8
jmp 0x42ad0a
cmp dword [ebp + 8], 0
jne 0x42ace1
push str._nUpdating_Registry_to_always_wait_for_connection_to_SofTrack_Server_Agent_n_rwhen_Local_Agent_is_first_loaded.
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x47716c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x42ad00
push str.WaitForever
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
push str._nUpdating_Registry_to_wait_5_mintes_for_connection_to_SofTrack_Server_Agent_n_rwhen_Local_Agent_is_first_loaded.
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42ad0f
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x47720c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ad5c
mov eax, dword [ebp - 4]
push eax
push 0x477248
call fcn.00452380
add esp, 8
jmp 0x42adab
cmp dword [ebp + 8], 0
jne 0x42ad78
push str._nUpdating_Registry_to_Show_Build_Error_at_load
call fcn.00452380
add esp, 4
jmp 0x42ad85
push str._nUpdating_Registry_to_Hide_Build_Error_at_load_n___if_error_occurs_the_agent_will_still_shutdown
call fcn.00452380
add esp, 4
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.DoNotShowBuildError
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42adb0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004536a0
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x477320
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ae06
mov eax, dword [ebp - 4]
push eax
push 0x47735c
call fcn.00452380
add esp, 8
jmp 0x42ae58
mov eax, 0x47737c
mov ecx, 0x477380
xor edx, edx
cmp dword [ebp - 8], 1
sete dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
mov eax, dword [ebp - 8]
push eax
push str._nUpdating_Registry_with_load_delay_of___d__second_s
call fcn.00452380
add esp, 0xc
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.LoadDelay
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42ae5d
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
call fcn.00452990
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x4773cc
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42aeb1
mov eax, dword [ebp - 4]
push eax
push 0x477408
call fcn.00452380
add esp, 8
jmp 0x42af09
mov eax, dword [ebp + 8]
push eax
push str._nUpdating_Registry_with_ZERO_NMTrack_of___d_
call fcn.00452380
add esp, 8
cmp dword [ebp + 8], 0
jne 0x42aee3
push 0x477458
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
jmp 0x42aeff
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.NoMeterTrack
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42af0e
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x477490
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42af55
mov eax, dword [ebp - 4]
push eax
push 0x4774cc
call fcn.00452380
add esp, 8
jmp 0x42b033
cmp dword [ebp + 8], 0
jne 0x42af9a
push str._nRemoving_Location_Code_from_Registry
call fcn.00452380
add esp, 4
push 0x477514
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42af95
push str._n_rError__d_removing_Location_Code__action_aborted
call fcn.00452380
add esp, 4
jmp 0x42b029
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 0x21
jae 0x42b018
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
test eax, eax
je 0x42b018
mov eax, dword [ebp + 0xc]
push eax
push str._nUpdating_Registry_with_Location_Code___s_
call fcn.00452380
add esp, 8
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push str.LocationCode
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b013
push str._n_rError__d_updating_Location_Code__action_aborted
call fcn.00452380
add esp, 4
jmp 0x42b029
mov eax, dword [ebp + 0xc]
push eax
push str._nLocation_Code_can_be_from_1_to_32_characters_in_length__the_value_of___s__does_not_meet_this_requirement__change_refused.
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b038
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x477650
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b07f
mov eax, dword [ebp - 4]
push eax
push 0x47768c
call fcn.00452380
add esp, 8
jmp 0x42b167
cmp dword [ebp + 0xc], 0
jne 0x42b0fe
mov dword [ebp - 8], 0x1fe
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x4776ac
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
push str._r_n__d_Fetch_Computer_Ldap___s_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x42b0f9
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
jmp 0x42b15d
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
je 0x42b15d
mov eax, dword [ebp + 8]
push eax
push str._nUpdating_Registry_with_Computer_Ldap___s_
call fcn.00452380
add esp, 8
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
push str.CNLDAP
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b15d
push str._n_rError__d_updating_Computer_Ldap__action_aborted
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b16c
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
push 0xf003f
push 0
push 0x47773c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b1b9
mov eax, dword [ebp - 4]
push eax
push 0x477778
call fcn.00452380
add esp, 8
jmp 0x42b307
cmp dword [ebp + 0xc], 0
jne 0x42b268
mov dword [ebp - 8], 0x200
mov byte [ebp - 0x207], 0
mov al, byte [ebp - 0x207]
mov byte [ebp - 0x208], al
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0
push 0x477798
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42b21a
movsx eax, byte [ebp - 0x208]
test eax, eax
jne 0x42b23b
push str._nBlock_Offline_Message_not_set__using_default
call fcn.00452380
add esp, 4
mov esi, str.Use_of_the_selected_Application_is_not_allowed_while_operating_offline.
mov edi, dword [ebp + 8]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
jmp 0x42b263
lea edi, [ebp - 0x208]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 8]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x42b2fa
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 0x76
jae 0x42b2e9
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
je 0x42b2e9
mov eax, dword [ebp + 8]
push eax
push str._nUpdating_Registry_with_Block_Offline_Message___s_
call fcn.00452380
add esp, 8
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
push str.CM_BLOCK_OFFLINE
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b2e4
push str._n_rError__d_updating_Block_Offline_Message__action_aborted
call fcn.00452380
add esp, 4
jmp 0x42b2fa
mov eax, dword [ebp + 8]
push eax
push str._nBlock_Offline_Message_can_be_from_1_to_117_characters_in_length__the_value_of___s__does_not_meet_this_requirement__change_refused.
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b30c
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x47792c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b353
mov eax, dword [ebp - 4]
push eax
push 0x477968
call fcn.00452380
add esp, 8
jmp 0x42b431
cmp dword [ebp + 8], 0
jne 0x42b398
push str._nRemoving_Client_Group_Prefix_from_Registry
call fcn.00452380
add esp, 4
push 0x4779b4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b393
push str._n_rError__d_removing_Client_Group_Prefix__action_aborted
call fcn.00452380
add esp, 4
jmp 0x42b427
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 0xa
jae 0x42b416
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
test eax, eax
je 0x42b416
mov eax, dword [ebp + 0xc]
push eax
push str._nUpdating_Registry_with_Client_Group_Prefix___s_
call fcn.00452380
add esp, 8
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push str.ClientGroup
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b411
push str._n_rError__d_updating_Client_Group_Prefix__action_aborted
call fcn.00452380
add esp, 4
jmp 0x42b427
mov eax, dword [ebp + 0xc]
push eax
push str._nClient_Group_Prefix_can_be_from_1_to_10_characters_in_length__the_value_of___s__does_not_meet_this_requirement__change_refused.
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b436
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x477b00
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b47d
mov eax, dword [ebp - 4]
push eax
push 0x477b3c
call fcn.00452380
add esp, 8
jmp 0x42b4b4
mov eax, dword [ebp + 8]
push eax
push str._nUpdating_Registry_parameter__ConvertServerNameToIPAddress__with_value_of___d__n____1Convert_to_IPv4__0Do_not_convert_
call fcn.00452380
add esp, 8
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.ConvertServerNameToIPAddress
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret