joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438460
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, dword [esp + 0x21c]
mov ebp, 1
or ecx, 0xffffffff
xor eax, eax
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x10]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
test ebp, ebp
lea eax, [esp + 0x10]
jle 0x4384d0
push eax
call fcn.0046830b
push 0x5c
push eax
call fcn.00467bf5
add esp, 0xc
test eax, eax
je 0x4384d7
inc esi
cmp esi, ebp
jl 0x4384b6
test eax, eax
je 0x4384d7
mov byte [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0x10]
push ecx
call esi
test eax, eax
jne 0x4384f8
push eax
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x43855d
lea eax, [esp + 0x114]
push eax
call esi
lea esi, [esp + 0x10]
mov eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x43852c
test cl, cl
je 0x438528
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x43852c
add eax, 2
add esi, 2
test cl, cl
jne 0x438508
xor eax, eax
jmp 0x438531
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x438550
inc ebp
cmp ebp, 0x3e7
jl 0x438489
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
lea eax, [esp + 0x114]
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret
Function at 0x439580
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
or ecx, 0xffffffff
sub esp, 0x30c
push esi
push edi
mov edi, dword [esp + 0x318]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 8]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jae 0x4395d1
pop edi
mov eax, 1
pop esi
add esp, 0x30c
ret
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
mov al, byte [esp + ecx + 6]
dec ecx
push ebx
xor ebx, ebx
cmp al, 0x5c
push ebp
jne 0x43961a
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x10]
mov al, byte [ecx + edx - 3]
dec ecx
sub edx, 2
cmp al, 0x3a
je 0x43961a
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0xf], bl
lea eax, [esp + 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor ebp, ebp
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x114]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x114], bl
je 0x4396ae
mov eax, 1
xor edx, edx
cmp edx, ebp
jg 0x4396ae
mov cl, byte [esp + eax + 0x114]
cmp cl, bl
je 0x4396ae
cmp cl, 0x5c
jne 0x43968a
cmp byte [esp + eax + 0x113], 0x5c
je 0x43968a
inc edx
cmp edx, ebp
jg 0x439694
inc eax
cmp eax, 0x104
jl 0x439667
jmp 0x4396ae
cmp byte [esp + eax + 0x113], 0x3a
jne 0x4396a7
mov byte [esp + eax + 0x115], bl
jmp 0x4396ae
mov byte [esp + eax + 0x114], bl
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4396d3
push ebx
lea edx, [esp + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x439735
lea esi, [esp + 0x114]
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x439702
cmp cl, bl
je 0x4396fe
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x439702
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4396de
xor eax, eax
jmp 0x439707
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x439718
inc ebp
cmp ebp, 0x3e7
jl 0x43962f
xor esi, esi
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0x30c
ret
mov esi, 1
jmp 0x43971a
Function at 0x4436b0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x5a2154]
sub esp, 0x160
push esi
xor esi, esi
cmp eax, esi
jne 0x44383d
push ebx
push ebp
push edi
mov dword [0x5a2154], 1
call fcn.00452010
push esi
mov dword [esp + 0x18], eax
call fcn.00452db0
call fcn.00451970
mov eax, dword [str.checker.exe]
mov ecx, dword [0x4b34a8]
mov edx, dword [0x4b34ac]
push 0x443850
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
call fcn.004518a0
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add esp, 8
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov word [esp + 0x58], 0xa
mov word [esp + 0x5a], si
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x10], 0x11c1
mov dword [0x5a2150], esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x90]
push eax
call ebp
test eax, eax
je 0x443801
push 2
call edi
call fcn.00451970
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
test eax, eax
je 0x4437eb
cmp dword [0x5a2150], esi
jne 0x4437eb
cmp dword [esp + 0x10], 0x103
jne 0x4437eb
push 2
call edi
call fcn.00451970
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push ecx
call ebx
test eax, eax
jne 0x4437c0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x5a2150], esi
jne 0x44381b
push 0x4b3490
call fcn.00451cb0
add esp, 4
jmp 0x443723
push 0x443850
call fcn.00451910
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, esi
pop edi
pop ebp
pop ebx
je 0x44383d
push 1
call fcn.00452db0
add esp, 4
push esi
call fcn.00427d70
add esp, 4
pop esi
add esp, 0x160
ret
Function at 0x451970
Capabilities:
Open clipboard
Terminate process
Write clipboard data

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
xor esi, esi
push esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x4519cb
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [esp + 0x10], 0x12
je 0x4519d4
lea ecx, [esp + 0xc]
push ecx
call ebx
cmp dword [esp + 0x10], 0xc000
jae 0x4519b7
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
inc esi
call edi
test eax, eax
jne 0x451994
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00467da5
nop
nop

Function at 0x4519e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x451a08
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
or ecx, 0xffffffff
mov edx, eax
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov dword [0x5a8ba0], 1
xor eax, eax
pop ebx
ret
Function at 0x451cb0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x410
push esi
lea eax, [esp + 0x418]
lea ecx, [esp + 4]
mov edx, 4
mov esi, dword [eax + 4]
add eax, 4
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x451cc7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00466e90
mov eax, dword [0x5a8ba8]
add esp, 0x18
test eax, eax
pop esi
je 0x451d0a
call eax
call fcn.004517c0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [esp + 0x10]
push eax
call fcn.00451a70
add esp, 4
push 0x40015
call fcn.004517d0
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004517c0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x451d56
mov eax, dword [0x5a8bac]
test eax, eax
je 0x451d4f
call eax
push 0xffffffffffffffff
call fcn.00467da5
add esp, 0x410
ret

Function at 0x451d60
Capabilities:
Terminate process

Disassembly:
sub esp, 0x410
push esi
lea eax, [esp + 0x418]
lea ecx, [esp + 4]
mov edx, 4
mov esi, dword [eax + 4]
add eax, 4
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x451d77
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00466e90
mov eax, dword [0x5a8ba8]
add esp, 0x18
test eax, eax
pop esi
je 0x451dba
call eax
call fcn.004517c0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [esp + 0x10]
push eax
call fcn.00451a70
add esp, 4
push 0x40010
call fcn.004517d0
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004517c0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x451e06
mov eax, dword [0x5a8bac]
test eax, eax
je 0x451dff
call eax
push 0xffffffffffffffff
call fcn.00467da5
add esp, 0x410
ret

Function at 0x451e10
Capabilities:
Terminate process

Disassembly:
sub esp, 0x410
push esi
lea eax, [esp + 0x418]
lea ecx, [esp + 4]
mov edx, 4
mov esi, dword [eax + 4]
add eax, 4
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x451e27
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00466e90
mov eax, dword [0x5a8ba4]
add esp, 0x18
test eax, eax
pop esi
je 0x451e6a
call eax
call fcn.004517c0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [esp + 0x10]
push eax
call fcn.00451a70
add esp, 4
push 0x40030
call fcn.004517d0
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004517c0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x451eb6
mov eax, dword [0x5a8bac]
test eax, eax
je 0x451eaf
call eax
push 0xffffffffffffffff
call fcn.00467da5
add esp, 0x410
ret
Function at 0x454da0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x1a0
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0xac]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [0x5b8c3c]
lea ecx, [eax + eax*2]
cmp dword [ecx*4 + 0x4b4764], 0xffffffff
mov dword [0x5b8c20], 0
mov dword [esp + 0x10], 0
je 0x454ee6
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
mov ebp, 0x2710
mov ecx, 0x25
lea edi, [esp + 0x20]
push eax
mov dword [esp + 0x20], ebp
xor ebx, ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
je 0x454eb2
cmp dword [esp + 0x80], 0xf
jb 0x454e86
mov ecx, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*4]
shl eax, 2
xor edx, edx
div esi
cmp eax, 0x87
jg 0x454e42
xor edx, edx
jmp 0x454e4d
xor edx, edx
cmp eax, 0xaf
setge dl
inc edx
mov eax, dword [0x5b8c3c]
mov edi, dword [esp + 0x10]
lea edi, [edi + eax*2]
add eax, edi
cmp edx, dword [eax*4 + 0x4b4764]
jne 0x454e86
cmp ecx, dword [esp + 0x1b4]
jl 0x454e86
cmp esi, dword [esp + 0x1b8]
jl 0x454e86
cmp ecx, ebp
jg 0x454e86
cmp esi, dword [esp + 0x14]
jg 0x454e86
mov ebp, ecx
mov dword [esp + 0x14], esi
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
inc ebx
push ebx
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
jne 0x454e12
cmp ebp, 0x2710
jne 0x454ed5
mov ecx, dword [esp + 0x10]
mov eax, dword [0x5b8c3c]
inc ecx
mov dword [esp + 0x10], ecx
lea ecx, [ecx + eax*2]
add eax, ecx
cmp dword [eax*4 + 0x4b4764], 0xffffffff
jne 0x454de5
jmp 0x454ee6
mov dword [esp + 0x1b4], ebp
mov dword [0x5b8c20], 1
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esp + 0x1b4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a0
ret
Function at 0x454f10
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x1a0
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0xac]
push eax
push 0x103
mov dword [0x5b8c20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [0x5b8c3c]
lea ecx, [eax + eax*2]
cmp dword [ecx*4 + 0x4b4788], 0xffffffff
mov dword [esp + 0x10], 0
je 0x455056
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
mov ebp, 0x2710
mov ecx, 0x25
lea edi, [esp + 0x20]
push eax
mov dword [esp + 0x20], ebp
xor ebx, ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
je 0x455022
cmp dword [esp + 0x80], 0xf
jb 0x454ff6
mov ecx, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*4]
shl eax, 2
xor edx, edx
div esi
cmp eax, 0x87
jg 0x454fb2
xor edx, edx
jmp 0x454fbd
xor edx, edx
cmp eax, 0xaf
setge dl
inc edx
mov eax, dword [0x5b8c3c]
mov edi, dword [esp + 0x10]
lea edi, [edi + eax*2]
add eax, edi
cmp edx, dword [eax*4 + 0x4b4788]
jne 0x454ff6
cmp ecx, dword [esp + 0x1b4]
jl 0x454ff6
cmp esi, dword [esp + 0x1b8]
jl 0x454ff6
cmp ecx, dword [esp + 0x14]
jg 0x454ff6
cmp esi, ebp
jg 0x454ff6
mov dword [esp + 0x14], ecx
mov ebp, esi
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
inc ebx
push ebx
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
jne 0x454f82
cmp ebp, 0x2710
jne 0x455045
mov ecx, dword [esp + 0x10]
mov eax, dword [0x5b8c3c]
inc ecx
mov dword [esp + 0x10], ecx
lea ecx, [ecx + eax*2]
add eax, ecx
cmp dword [eax*4 + 0x4b4788], 0xffffffff
jne 0x454f55
jmp 0x455056
mov dword [esp + 0x1b8], ebp
mov dword [0x5b8c20], 1
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esp + 0x1b8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a0
ret

Function at 0x455a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [esp + 0x21c]
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
mov edi, dword [esp + 0x22c]
push esi
push eax
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x200
or ebp, 0xffffffff
call fcn.00468010
mov edx, dword [esp + 0x22c]
mov eax, dword [esp + 0x228]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push edx
push eax
mov byte [edi + esi - 1], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x455aac
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x228]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x455aac
cmp dword [esp + 0x14], 1
jne 0x455aac
push esi
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.00468010
add esp, 0xc
mov byte [edi + esi - 1], 0
xor ebp, ebp
mov eax, dword [esp + 0xc]
test eax, eax
je 0x455abb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x20c
ret
Function at 0x455ad0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0x4c9008
push 0
push ecx
push edx
mov dword [esp + 0x28], 0
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x455b32
mov edx, dword [esp + 0x18]
push edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
jne 0x455b32
xor esi, esi
mov eax, dword [esp + 4]
test eax, eax
je 0x455b5c
test esi, esi
jne 0x455b51
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x455b51
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 4]
test eax, eax
je 0x455b5c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x455b70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [esp + 0x41c]
push ebp
push esi
mov esi, dword [esp + 0x42c]
push edi
mov edi, dword [esp + 0x42c]
push esi
push eax
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x200
or ebp, 0xffffffff
call fcn.00468010
mov ecx, dword [esp + 0x42c]
mov edx, dword [esp + 0x428]
push ecx
push edx
lea eax, [esp + 0x2c]
push str.Software_s_s
push eax
mov byte [edi + esi - 1], 0
call fcn.00466e90
add esp, 0x1c
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x455c3b
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x428]
lea ecx, [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x455c3b
cmp dword [esp + 0x10], 1
jne 0x455c3b
push esi
lea edx, [esp + 0x21c]
push edx
push edi
call fcn.00468010
add esp, 0xc
mov byte [edi + esi - 1], 0
xor ebp, ebp
mov eax, dword [esp + 0xc]
test eax, eax
je 0x455c4a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x40c
ret
Function at 0x455c60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x204
mov eax, dword [esp + 0x20c]
mov ecx, dword [esp + 0x208]
push esi
push eax
push ecx
lea edx, [esp + 0x10]
push str.Software_s_s
push edx
mov dword [esp + 0x14], 0
or esi, 0xffffffff
call fcn.00466e90
add esp, 0x10
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0x4c9008
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x455cef
mov edx, dword [esp + 0x218]
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x220]
push 1
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
jne 0x455cef
xor esi, esi
mov eax, dword [esp + 4]
test eax, eax
je 0x455cfe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x204
ret

Function at 0x455d10
Capabilities:
Set registry value

Disassembly:
sub esp, 0x204
mov eax, dword [esp + 0x20c]
mov ecx, dword [esp + 0x208]
push esi
push eax
push ecx
lea edx, [esp + 0x10]
push str.Software_s_s
push edx
mov dword [esp + 0x14], 0
or esi, 0xffffffff
call fcn.00466e90
add esp, 0x10
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0x4c9008
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x455d9f
mov edx, dword [esp + 0x218]
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x220]
push 1
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
jne 0x455d9f
xor esi, esi
mov eax, dword [esp + 4]
test eax, eax
je 0x455dc1
test esi, esi
jne 0x455db6
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 4]
test eax, eax
je 0x455dc1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x204
ret

Function at 0x455dd0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x414]
push esi
push eax
lea ecx, [esp + 0xc]
push 0x4ad158
push ecx
call fcn.00466e90
mov edx, dword [esp + 0x41c]
mov eax, dword [esp + 0x418]
push edx
push eax
lea ecx, [esp + 0x21c]
push str.Software_s_s
push ecx
mov dword [esp + 0x20], 0
or esi, 0xffffffff
call fcn.00466e90
add esp, 0x1c
push 0
lea edx, [esp + 8]
push edx
push 0
push 0xf003f
push 0
push 0x4c9008
push 0
lea eax, [esp + 0x224]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x455e7b
mov edx, dword [esp + 0x414]
push edi
or ecx, 0xffffffff
lea edi, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
jne 0x455e7b
xor esi, esi
mov eax, dword [esp + 4]
test eax, eax
je 0x455e8a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x404
ret