joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415da0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x46baf6
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x16c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x184]
mov dword fs:[0], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x198]
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00402ac0
push 1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x194], 0
call fcn.004168c0
push 0x5c
push eax
call fcn.00416a30
add esp, 8
lea ecx, [esp + 0x18]
mov bl, al
call fcn.00402b30
test bl, bl
je 0x415e3c
push 0x4744c0
lea ecx, [esp + 0x18]
call fcn.00402310
push 0x101
push 0x160
lea edx, [esp + 0x28]
push edx
push 0
lea ecx, [esp + 0x24]
call fcn.00402b80
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push eax
call ebx
test eax, eax
jne 0x415e80
push 0x4744c4
lea ecx, [esi + 0x58]
call fcn.00402b60
lea ecx, [esp + 0x14]
call fcn.00402b30
xor eax, eax
jmp 0x415f4a
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.USER32.dll_DestroyIcon]
push eax
call edi
mov ebp, dword [esp + 0x24]
push 0x103
push 0x160
lea ecx, [esp + 0x28]
push ecx
push 0
lea ecx, [esp + 0x24]
call fcn.00402b80
push eax
call ebx
test eax, eax
jne 0x415eb9
push str.Error_Gettting_SystemFileInfo_
jmp 0x415e68
mov edx, dword [esp + 0x20]
push edx
call edi
mov edi, dword [esp + 0x24]
push 1
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004168c0
push 0x474504
push eax
call fcn.004169c0
add esp, 8
lea ecx, [esp + 0x18]
mov bl, al
call fcn.00402b30
test bl, bl
je 0x415f07
push 0
lea ecx, [esp + 0x18]
call fcn.00402ba0
dec eax
push eax
lea ecx, [esp + 0x1c]
call fcn.00416a60
mov eax, dword [esp + 0x1c]
push 0xffff0002
lea ecx, [esp + 0x18]
cmp eax, 0xffff0000
jne 0x415f25
push eax
push edi
push ebp
call fcn.00402b80
jmp 0x415f35
push eax
push edi
push ebp
call fcn.00402b80
push eax
mov ecx, esi
call fcn.00415f80
push eax
mov ecx, esi
call fcn.00416f30
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00402b30
mov eax, esi
mov ecx, dword [esp + 0x184]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.0044f50d
add esp, 0x17c
ret 8
Function at 0x416080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46bb57
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x10]
call fcn.0043ed3a
mov esi, dword [esp + 0x38]
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
call fcn.00402ac0
mov eax, esi
mov byte [esp + 0x30], 1
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4160d0
sub eax, edx
cmp eax, 3
jne 0x4160f8
cmp byte [esi + 1], 0x3a
jne 0x4160f1
cmp byte [esi + 2], 0x5c
jne 0x4160f1
push 0x474508
jmp 0x4160fd
push 0x47450c
jmp 0x4160fd
push 0x474514
lea ecx, [esp + 0x10]
call fcn.00402310
push 0
lea ecx, [esp + 0x10]
call fcn.00402b80
push eax
lea ecx, [esp + 0x18]
call fcn.0043edcf
test eax, eax
je 0x416168
nop
lea ecx, [esp + 0x10]
call fcn.0043ea3e
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00416d80
test eax, eax
je 0x416145
lea ecx, [esp + 0x10]
call fcn.0043ecff
test eax, eax
je 0x416198
lea ecx, [esp + 0x10]
call fcn.00416d80
test eax, eax
jne 0x416164
cmp dword [edi + 0x54], eax
je 0x416164
lea ecx, [esp + 0x10]
call fcn.00416d90
test eax, eax
je 0x416198
test esi, esi
jne 0x416120
lea ecx, [esp + 0xc]
call fcn.00402b30
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call fcn.0043ed60
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
lea ecx, [esp + 0xc]
call fcn.00402b30
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call fcn.0043ed60
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4

Function at 0x4179a0
Capabilities:
Get file size

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x804]
mov dword [esi + 0x818], 0
mov dword [esi + 0x81c], 0
test eax, eax
jne 0x4179c7
xor edx, edx
pop esi
pop ecx
ret
push edi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4179ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4179ed
pop edi
xor eax, eax
xor edx, edx
pop esi
pop ecx
ret
mov edx, dword [esp + 8]
push 1
push 0
push 0
push edx
call fcn.00451390
xor ecx, ecx
add eax, edi
adc edx, ecx
pop edi
mov dword [esi + 0x818], eax
mov dword [esi + 0x81c], edx
pop esi
pop ecx
ret

Function at 0x417ac0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 0xc]
mov dword [edx], 0
mov eax, dword [ecx + 0x804]
test eax, eax
jne 0x417ad9
xor al, al
ret 0xc
mov ecx, dword [esp + 8]
push 0
push edx
mov edx, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
ret 0xc

Function at 0x417b00
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 0x804]
test eax, eax
jne 0x417b0f
xor al, al
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
ret 0xc
Function at 0x418580
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, ecx
mov eax, dword [esi + 0x1388]
mov dword [ebp], eax
mov ecx, dword [esi + 0x138c]
mov dword [ebp + 4], ecx
mov eax, dword [esi + 0x1388]
mov ecx, dword [esi + 0x1184]
mov edx, dword [esi + 0x1180]
push edi
mov edi, dword [esp + 0x28]
add eax, edi
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x138c]
adc eax, ebx
cmp eax, ecx
mov dword [esp + 0x10], edx
jl 0x4185ff
mov eax, edx
jg 0x4185d9
cmp dword [esp + 0x18], eax
jbe 0x4185ff
sub eax, dword [esi + 0x1388]
sbb ecx, dword [esi + 0x138c]
mov edi, eax
mov ebx, ecx
or eax, ebx
jne 0x4185ff
pop edi
pop esi
mov dword [ebp], eax
mov dword [ebp + 4], eax
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x10
mov edx, dword [esi + 0x1390]
mov eax, dword [esi + 0x1394]
mov ecx, dword [0x49333c]
mov dword [esp + 0x28], edx
add edx, edi
mov dword [esp + 0x2c], eax
adc eax, ebx
cmp eax, ecx
jl 0x418734
mov eax, dword [0x493338]
jg 0x418634
cmp edx, eax
jbe 0x418734
sub eax, dword [esp + 0x28]
sbb ecx, dword [esp + 0x2c]
mov dword [esi + 0x1178], eax
mov dword [esi + 0x117c], ecx
test ecx, ecx
jl 0x418698
jg 0x418652
test eax, eax
jbe 0x418698
mov edx, dword [esp + 0x24]
push 0
lea ebp, [esi + 0x1170]
push ebp
mov ecx, eax
mov eax, dword [esi + 0x1160]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp]
add dword [esi + 0x1388], ecx
mov edx, dword [esi + 0x1178]
mov eax, dword [esi + 0x117c]
adc dword [esi + 0x138c], 0
add dword [esi + 0x1390], edx
adc dword [esi + 0x1394], eax
mov ecx, esi
call fcn.004182a0
test al, al
jne 0x4186b4
pop edi
pop esi
pop ebp
mov byte [0x4932e7], 1
pop ebx
add esp, 0x10
ret 0x10
mov eax, edi
sub eax, dword [esi + 0x1178]
mov ecx, ebx
sbb ecx, dword [esi + 0x117c]
mov dword [esp + 0x2c], ecx
js 0x418787
jg 0x4186d8
test eax, eax
jbe 0x418787
mov eax, dword [esi + 0x1178]
mov ecx, dword [esp + 0x24]
push 0
lea ebp, [esi + 0x1170]
push ebp
mov edx, edi
sub edx, eax
push edx
mov edx, dword [esi + 0x1160]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp]
add dword [esi + 0x1388], eax
mov al, 1
adc dword [esi + 0x138c], 0
sub edi, dword [esi + 0x1178]
sbb ebx, dword [esi + 0x117c]
add dword [esi + 0x1390], edi
pop edi
adc dword [esi + 0x1394], ebx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x1160]
push 0
lea eax, [esi + 0x1170]
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x1170]
add dword [esi + 0x1388], eax
mov ecx, dword [esi + 0x1388]
adc dword [esi + 0x138c], 0
add dword [esi + 0x1390], edi
mov edx, dword [esi + 0x138c]
adc dword [esi + 0x1394], ebx
sub ecx, dword [ebp]
sbb edx, dword [ebp + 4]
mov dword [ebp], ecx
mov dword [ebp + 4], edx
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x10
Function at 0x41a9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c3ed
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, 0x12
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], 6
mov dword [esi + 0xe8], 0xe
call fcn.00404a70
cmp eax, 0x60
jle 0x41aa4a
mov dword [esi + 0xe0], 0x16
mov dword [esi + 0xe4], 8
mov dword [esi + 0xe8], edi
push 0x3b
lea eax, [esp + 0x10]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xc0]
mov dword [esp + 0x48], 0
call fcn.00429140
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call fcn.00429130
push 0x3c
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
mov edi, eax
push 0x13
lea edx, [esp + 0x28]
push edx
mov ecx, 0x4948b4
mov dword [esp + 0x4c], 1
call fcn.0041f860
push edi
push eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x50], 2
call fcn.0041ab30
push eax
lea ecx, [esi + 0xcc]
mov byte [esp + 0x48], 3
call fcn.00429140
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 2
call fcn.00429130
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 1
call fcn.00429130
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x4c]
push ecx
push 0x8c
mov ecx, esi
mov byte [esi + 0xdc], 0
call fcn.004029b0
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
ret 4
Function at 0x41ca20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46ca4c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x31
lea eax, [esp + 0xc]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xc0]
mov dword [esp + 0x2c], 0
call fcn.00429140
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
push 0x32
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xcc]
mov dword [esp + 0x2c], 1
call fcn.00429140
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
mov edx, dword [esp + 0x30]
push edx
push 0x8a
mov ecx, esi
mov byte [esi + 0xdc], 0
call fcn.004029b0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4

Function at 0x41cae0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
cmp byte [esi + 0xde], al
je 0x41cb3a
push 0x4932c4
push eax
push esi
push 0x406d90
mov byte [esi + 0xde], al
push eax
push 0x4932c8
mov byte [0x4932e6], al
mov dword [0x4932c8], 0xc
mov dword [0x4932cc], eax
mov dword [0x4932d0], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x100
push eax
mov dword [0x4932c0], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 5
mov ecx, esi
call fcn.00439059
pop esi
ret

Function at 0x41e8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46ce2e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x34]
push eax
lea ecx, [esi + 0x1c]
mov dword [esp + 0x30], 0
call fcn.00429140
push str..TempFile
lea ecx, [esp + 0x10]
call fcn.00428f60
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x38], 1
call fcn.0041e990
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.00429130
sub esp, 0xc
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00428fd0
mov ecx, esi
call fcn.0041ea30
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call fcn.00429130
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 0xc
Function at 0x41fc10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46d173
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push edi
push eax
mov dword [esp + 0x34], 0
call fcn.00413f70
add esp, 8
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.00429040
sub eax, 2
push eax
push 2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call fcn.00429350
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.00429140
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call fcn.00429130
push edi
mov ecx, esi
call fcn.0041f6c0
mov edi, eax
cmp edi, 0xffffffff
je 0x41fd08
mov ecx, dword [esi + 0x18]
lea edx, [esp + 0xc]
push edx
push edi
add ecx, 8
call fcn.00402590
mov ecx, eax
call fcn.00429140
push 0x475d58
lea ecx, [esp + 0x1c]
call fcn.00428f60
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x18]
push eax
push edi
add ecx, 8
mov byte [esp + 0x34], 3
call fcn.00402590
mov ecx, eax
call fcn.00429280
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call fcn.00429130
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esi + 0x18]
push edi
add ecx, 8
call fcn.00402590
mov ecx, eax
call fcn.00429280
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.00429130
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10
Function at 0x4232c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46d80c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x18
lea eax, [esp + 0xc]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xc0]
mov dword [esp + 0x2c], 0
call fcn.00429140
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
push 0x19
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xcc]
mov dword [esp + 0x2c], 1
call fcn.00429140
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
mov edx, dword [esp + 0x30]
push edx
push 0x86
mov ecx, esi
mov byte [esi + 0xdc], 0
call fcn.004029b0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4

Function at 0x423ff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46da70
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x21
lea eax, [esp + 0xc]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
lea ecx, [eax + 4]
mov dword [esp + 0x28], 0
call fcn.00402b80
push eax
lea ecx, [esi + 0xe0]
call fcn.00438fb7
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
push 0x22
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
lea ecx, [eax + 4]
mov dword [esp + 0x28], 1
call fcn.00402b80
push eax
lea ecx, [esi + 0x134]
call fcn.00438fb7
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
push 0x23
lea edx, [esp + 0x18]
push edx
mov ecx, 0x4948b4
call fcn.0041f860
lea ecx, [eax + 4]
mov dword [esp + 0x28], 2
call fcn.00402b80
push eax
lea ecx, [esi + 0x188]
call fcn.00438fb7
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
mov eax, dword [esp + 0x30]
mov dword [esi + 0xd8], eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
Function at 0x424930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46dc21
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x1f
lea eax, [esp + 0xc]
push eax
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xc0]
mov dword [esp + 0x2c], 0
call fcn.00429140
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
push 0x20
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4948b4
call fcn.0041f860
push eax
lea ecx, [esi + 0xcc]
mov dword [esp + 0x2c], 1
call fcn.00429140
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429130
mov edx, dword [esp + 0x30]
push edx
push 0x88
mov ecx, esi
mov byte [esi + 0xdc], 0
call fcn.004029b0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4

Function at 0x425070
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x46dcca
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x81c], eax
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x840]
mov dword [esp + 0x834], 0
call fcn.00402b80
push eax
lea eax, [esp + 0x2c]
push 0x800
push eax
call fcn.0044fb53
lea esi, [esp + 0x34]
add esp, 0xc
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x4250e0
sub esi, ecx
test esi, esi
jle 0x4250fb
mov al, 0x5c
nop
cmp byte [esp + esi + 0x28], al
je 0x4250fb
dec esi
test esi, esi
jg 0x4250f0
lea ecx, [esp + 0x83c]
push ecx
lea ecx, [esp + 0x10]
inc esi
call fcn.00428fd0
push 1
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x28], esp
lea edx, [esi - 1]
push edx
push 1
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x850], 1
call fcn.00429350
mov ecx, edi
call fcn.00424dc0
lea ecx, [esp + 0xc]
call fcn.00429040
sub eax, esi
push eax
inc esi
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.00429350
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x838], 2
call fcn.00429140
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 1
call fcn.00429130
lea ecx, [esp + 0x10]
call fcn.00402b80
mov edx, dword [edi + 8]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x834], 0
call fcn.00429130
lea ecx, [esp + 0x83c]
mov dword [esp + 0x834], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.0044f50d
add esp, 0x82c
ret 0xc
Function at 0x4251e0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x46dd16
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x81c], eax
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x840]
mov dword [esp + 0x834], 0
call fcn.00402b80
push eax
lea eax, [esp + 0x2c]
push 0x800
push eax
call fcn.0044fb53
lea esi, [esp + 0x34]
add esp, 0xc
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x425250
sub esi, ecx
test esi, esi
jle 0x42526b
mov al, 0x5c
nop
cmp byte [esp + esi + 0x28], al
je 0x42526b
dec esi
test esi, esi
jg 0x425260
lea ecx, [esp + 0x83c]
push ecx
lea ecx, [esp + 0x10]
inc esi
call fcn.00428fd0
push 1
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x28], esp
lea edx, [esi - 1]
push edx
push 1
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x850], 1
call fcn.00429350
mov ecx, edi
call fcn.00424dc0
lea ecx, [esp + 0xc]
call fcn.00429040
sub eax, esi
push eax
inc esi
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.00429350
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x838], 2
call fcn.00429140
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 1
call fcn.00429130
lea ecx, [esp + 0x10]
call fcn.00402b80
mov edx, dword [edi + 8]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x834], 0
call fcn.00429130
lea ecx, [esp + 0x83c]
mov dword [esp + 0x834], 0xffffffff
call fcn.00429130
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.0044f50d
add esp, 0x82c
ret 0xc

Function at 0x425370
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46dd6e
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0xa38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0xa50]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa60]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], ebx
mov ebp, 1
mov dword [esp + 0xa58], ebp
cmp dword [edi + 8], ebx
jne 0x4253dd
push 0x476d2a
mov ecx, esi
call fcn.00428f60
jmp 0x425432
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
lea ecx, [esp + 0xa78]
mov dword [esp + 0x28], 0x800
call fcn.00402b80
push eax
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x425426
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
mov byte [esp + ecx + 0x24], bl
push edx
mov ecx, esi
call fcn.00429050
jmp 0x425432
push 0x476d2b
mov ecx, esi
call fcn.00428f60
lea ecx, [esp + 0xa64]
mov dword [esp + 0x14], ebp
mov byte [esp + 0xa58], bl
call fcn.00429130
mov eax, esi
mov ecx, dword [esp + 0xa50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa38]
xor ecx, esp
call fcn.0044f50d
add esp, 0xa48
ret 0x10
Function at 0x425750
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x46ddda
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.00450c60
mov eax, dword [0x491c04]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 0x201c]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
mov ebx, 1
push eax
lea ecx, [esp + 0x203c]
mov dword [esp + 0x2028], ebx
call fcn.004292a0
lea ecx, [esp + 0x10]
call fcn.00402b80
push eax
lea ecx, [esp + 0x1c]
push 0x1000
push ecx
call fcn.0044fb53
add esp, 0xc
lea edx, [esp + 0x1018]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00425610
cmp dword [esi + 8], 0
je 0x425849
push eax
lea ecx, [esp + 0x101c]
push ecx
push 3
push 0
lea ecx, [esp + 0x2040]
call fcn.00402b80
mov edx, dword [esi + 8]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x425849
lea ecx, [esp + 0xc]
mov byte [esp + 0x2024], bl
call fcn.00429130
lea ecx, [esp + 0x202c]
mov byte [esp + 0x2024], 0
call fcn.00429130
lea ecx, [esp + 0x2038]
mov dword [esp + 0x2024], 0xffffffff
call fcn.00429130
mov al, bl
jmp 0x425886
lea ecx, [esp + 0xc]
mov byte [esp + 0x2024], bl
call fcn.00429130
lea ecx, [esp + 0x202c]
mov byte [esp + 0x2024], 0
call fcn.00429130
lea ecx, [esp + 0x2038]
mov dword [esp + 0x2024], 0xffffffff
call fcn.00429130
xor al, al
mov ecx, dword [esp + 0x201c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.0044f50d
add esp, 0x201c
ret 0x18

Function at 0x4258b0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x46de18
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x491c04]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [esp + 0x10], 1
je 0x425944
lea ecx, [esp + 0x24]
call fcn.00429040
push eax
lea ecx, [esp + 0x2c]
call fcn.00402b80
push eax
push 1
push 0
lea ecx, [esp + 0x2c]
call fcn.00402b80
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x425944
lea ecx, [esp + 0x18]
mov byte [esp + 0x10], al
call fcn.00429130
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
call fcn.00429130
mov al, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x18
lea ecx, [esp + 0x18]
mov byte [esp + 0x10], 0
call fcn.00429130
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
call fcn.00429130
xor al, al
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x18