joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
push 0x3000
call fcn.0041addb
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4110e2
push 5
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4112cb
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a8e88
push 0x422c10
call fcn.0041a84c
add esp, 8
push 0x422ce8
mov eax, dword [ebp - 4]
push eax
push 0x422c10
call fcn.004134c2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x411136
mov eax, dword [ebp - 4]
push eax
call fcn.0041a905
add esp, 4
mov eax, 0xffffffff
jmp 0x4112cb
mov ax, word [0x422ce8]
mov word [ebp - 8], ax
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0xc], eax
jmp 0x411251
test byte [ebp + 0xb], 0x20
je 0x41118a
push 0x422ce8
mov eax, dword [ebp - 4]
push eax
call fcn.00411591
add esp, 8
cmp eax, 0xffffffff
jne 0x41118a
mov eax, dword [ebp - 4]
push eax
call fcn.0041a905
add esp, 4
mov eax, 0xffffffff
jmp 0x4112cb
test byte [ebp + 0xb], 0x10
je 0x4111c4
push 0x422ce8
mov eax, dword [ebp - 4]
push eax
call fcn.004117cc
add esp, 8
cmp eax, 0xffffffff
jne 0x4111c4
mov eax, dword [ebp - 4]
push eax
call fcn.0041a905
add esp, 4
mov eax, 0xffffffff
jmp 0x4112cb
jmp 0x41126a
mov ax, word [0x422ce8]
mov word [ebp - 8], ax
test byte [ebp + 0xb], 0x10
je 0x41120d
push 0x422ce8
mov eax, dword [ebp - 4]
push eax
call fcn.00411a1f
add esp, 8
cmp eax, 0xffffffff
jne 0x41120d
mov eax, dword [ebp - 4]
push eax
call fcn.0041a905
add esp, 4
mov eax, 0xffffffff
jmp 0x4112cb
test byte [ebp + 0xb], 0x20
je 0x411247
push 0x422ce8
mov eax, dword [ebp - 4]
push eax
call fcn.004112d0
add esp, 8
cmp eax, 0xffffffff
jne 0x411247
mov eax, dword [ebp - 4]
push eax
call fcn.0041a905
add esp, 4
mov eax, 0xffffffff
jmp 0x4112cb
jmp 0x41126a
cmp dword [ebp - 0xc], 1
je 0x4111c9
cmp dword [ebp - 0xc], 2
je 0x411150
jmp 0x41126a
mov eax, dword [ebp - 8]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x422ce8]
cmp eax, ecx
je 0x4112b8
push 0x422ce8
mov eax, dword [ebp - 4]
push eax
push 0x422c10
call fcn.00413610
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4112b8
mov eax, dword [ebp - 4]
push eax
call fcn.0041a905
add esp, 4
mov eax, 0xffffffff
jmp 0x4112cb
mov eax, dword [ebp - 4]
push eax
call fcn.0041a905
add esp, 4
xor eax, eax
jmp 0x4112cb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4117cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x64
push 0x422ba0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a8f60
push 0x422ac0
call fcn.0041a850
add esp, 8
push 0x422ba0
push 0x422ac0
call fcn.0041a84c
add esp, 8
push 0x4a8f68
push 0x422ac0
call fcn.0041a84c
add esp, 8
push 0x4a8f6c
push 0x422ac0
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x422ac0
call fcn.00410fe5
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x411906
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x4a8f7c
call fcn.00410fe5
add esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x411893
push 0x80002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x411a1a
push 0x422ac0
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov bx, word [eax]
mov eax, dword [ebp - 8]
and eax, 0xffff
sub ebx, eax
push 0x4a8f88
call fcn.0041a7d8
add esp, 4
sub ebx, eax
sub ebx, 2
push ebx
push 0x4a8f94
call fcn.0041a7d8
add esp, 4
mov ecx, dword [ebp - 0x14]
add ecx, eax
add ecx, 2
push ecx
call fcn.00411d1d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4118f2
mov eax, 0xffffffff
jmp 0x411a1a
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
and eax, 0xffff
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x4a8fa0
call fcn.00410fe5
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x411a13
push 0x4a8d70
push 0
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
and eax, 0xffff
add eax, dword [ebp + 8]
sub eax, 3
push eax
call fcn.00411d1d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x411967
mov eax, 0xffffffff
jmp 0x411a1a
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
and eax, 0xffff
add eax, 2
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
push 0x4a8d70
push 0
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
and eax, 0xffff
add eax, dword [ebp + 8]
sub eax, 3
push eax
call fcn.00411d1d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4119b3
mov eax, 0xffffffff
jmp 0x411a1a
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
and eax, 0xffff
add eax, 2
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
push 0x4a8fac
push 0
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
and eax, 0xffff
add eax, dword [ebp + 8]
sub eax, 3
push eax
call fcn.00411d1d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4119ff
mov eax, 0xffffffff
jmp 0x411a1a
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
and eax, 0xffff
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
xor eax, eax
jmp 0x411a1a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412335
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a9020
push 0x422c10
call fcn.0041a84c
add esp, 8
push 0x422c10
call fcn.0041affb
add esp, 4
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a902c
push 0x422c10
call fcn.0041a84c
add esp, 8
push 0x422c10
call fcn.0041affb
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4123f5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x68], 0
push 0x64
push 0x422ba0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test byte [ebp + 0xb], 0x20
je 0x4124b0
push 0x422ba0
lea eax, [ebp - 0x64]
push eax
call fcn.0041a850
add esp, 8
push 0x4a903c
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call fcn.00412398
add esp, 4
test eax, eax
je 0x412466
push 0x200400b
call fcn.00405434
add esp, 4
mov dword [ebp - 0x68], 0xffffffff
push 0x422ba0
lea eax, [ebp - 0x64]
push eax
call fcn.0041a850
add esp, 8
push 0x4a9048
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call fcn.00412398
add esp, 4
test eax, eax
je 0x4124b0
push 0x200400a
call fcn.00405434
add esp, 4
mov dword [ebp - 0x68], 0xffffffff
test byte [ebp + 0xb], 0x10
je 0x41255f
push 0x422ba0
lea eax, [ebp - 0x64]
push eax
call fcn.0041a850
add esp, 8
push 0x4a9058
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
push 0x4a905c
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call fcn.00412398
add esp, 4
test eax, eax
je 0x412515
push 0x2004017
call fcn.00405434
add esp, 4
mov dword [ebp - 0x68], 0xffffffff
push 0x422ba0
lea eax, [ebp - 0x64]
push eax
call fcn.0041a850
add esp, 8
push 0x4a906c
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call fcn.00412398
add esp, 4
test eax, eax
je 0x41255f
push 0x2004015
call fcn.00405434
add esp, 4
mov dword [ebp - 0x68], 0xffffffff
mov eax, dword [ebp - 0x68]
jmp 0x412567
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41256c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x422c10
push 0x422cf0
call fcn.0041a850
add esp, 8
push 0x4a907c
push 0x422c10
call fcn.0041a84c
add esp, 8
push 2
push 0x422c10
call fcn.00421515
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412626
cmp dword [0x4cd140], 2
je 0x412602
cmp dword [ebp - 4], 0
je 0x4125fd
push 0x2010003
call fcn.00405434
add esp, 4
push 0x80005
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x412699
jmp 0x412626
push 0x2010003
call fcn.00405434
add esp, 4
push 0x80006
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x412699
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a9088
push 0x422c10
call fcn.0041a84c
add esp, 8
push 2
push 0x422c10
call fcn.00421515
add esp, 8
mov dword [ebp - 4], eax
cmp dword [0x4cd140], 2
je 0x412692
cmp dword [ebp - 4], 0
je 0x412692
push 0x2010004
call fcn.00405434
add esp, 4
push 0x80005
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x412699
xor eax, eax
jmp 0x412699
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413c46
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0
push 0x64
push 0x422ba0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x422ba0
lea eax, [ebp - 0x64]
push eax
call fcn.0041a850
add esp, 8
push 0x4a94b0
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
push str.hardlock.vxd
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call fcn.0040e228
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0xffffffff
jne 0x413ce0
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
push 0x422ba0
lea eax, [ebp - 0x64]
push eax
call fcn.0041a850
add esp, 8
push str.Api_1lnm.dll
lea eax, [ebp - 0x64]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x64]
push eax
call fcn.0040e265
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0xffffffff
jne 0x413d2b
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00413d41
add esp, 4
jmp 0x413d3c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41407f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
push esi
push edi
push 0x64
push 0x422c10
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system.ini
push 0x422c10
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x4140cd
push str._hasp_
lea eax, [ebp - 0x8c]
push eax
call fcn.0041a850
add esp, 8
jmp 0x4140e1
push str._HARDLOCK_
lea eax, [ebp - 0x8c]
push eax
call fcn.0041a850
add esp, 8
push 1
push 0x3000
call fcn.0041addb
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x414111
push 5
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4142b4
push 0x422ce8
mov eax, dword [ebp - 8]
push eax
push 0x422c10
call fcn.004134c2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x414146
mov eax, dword [ebp - 8]
push eax
call fcn.0041a905
add esp, 4
mov eax, 0xffffffff
jmp 0x4142b4
push 0x422c74
mov ax, word [0x422ce8]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00410fe5
add esp, 0x10
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x41419b
push 0x80002
call fcn.004054a2
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.0041a905
add esp, 4
mov eax, 0xffffffff
jmp 0x4142b4
push 0x422db0
xor eax, eax
mov ax, word [0x422ce8]
xor ecx, ecx
mov cx, word [0x422c74]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x90]
inc eax
push eax
push 0x4a9530
call fcn.00410fe5
add esp, 0x10
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x4141eb
mov ax, word [0x422db0]
mov word [ebp - 4], ax
jmp 0x414202
xor eax, eax
mov ax, word [0x422ce8]
xor ecx, ecx
mov cx, word [0x422c74]
sub eax, ecx
mov word [ebp - 4], ax
push 0x422c76
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x90]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00410fe5
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x414290
push pe_nt_image_headers32
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041a7d8
add esp, 4
mov ecx, dword [ebp - 0x94]
add ecx, eax
inc ecx
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0041a828
add esp, 0xc
push 0x4a8d70
mov eax, dword [ebp + 8]
push eax
call fcn.0041acc0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x414281
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
jmp 0x41428b
mov eax, dword [ebp + 8]
mov byte [eax + 0x80], 0
jmp 0x4142a1
push 0x4a9534
mov eax, dword [ebp + 8]
push eax
call fcn.0041a850
add esp, 8
mov eax, dword [ebp - 8]
push eax
call fcn.0041a905
add esp, 4
xor eax, eax
jmp 0x4142b4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414a7b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
call fcn.004143f0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x414ac8
push 0x4ccac4
lea eax, [ebp - 0xc]
push eax
call fcn.0041a850
add esp, 8
jmp 0x414ae1
push 0x4ccac8
lea eax, [ebp - 0xc]
push eax
call fcn.0041a850
add esp, 8
jmp 0x414ae1
cmp dword [ebp - 0x2c], 1
je 0x414a97
cmp dword [ebp - 0x2c], 2
je 0x414aad
jmp 0x414ae1
push str.ComputerType
lea eax, [ebp - 0x24]
push eax
call fcn.0041a850
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x414b82
cmp dword [ebp - 0x10], 2
jne 0x414b6b
lea eax, [ebp - 0xc]
push eax
call fcn.0041a7d8
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x414b66
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x414b89
jmp 0x414b82
push 0x10006
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x414b89
xor eax, eax
jmp 0x414b89
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414dd3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x414e50
cmp dword [ebp - 8], 2
jne 0x414e2c
push 0x4ccaf0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041a850
add esp, 8
xor eax, eax
jmp 0x414f63
push 0x2002000
call fcn.00405434
add esp, 4
push 0x10001
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f63
mov dword [ebp - 8], 0xea
mov dword [ebp - 0xc], pe_nt_image_headers32
jmp 0x414e6a
add dword [ebp - 0xc], 0x80
cmp dword [ebp - 8], 0xea
jne 0x414ec7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xea
jne 0x414ec2
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041b559
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x414e63
cmp dword [ebp - 8], 0
je 0x414f21
cmp dword [ebp - 8], 2
jne 0x414ef3
push 0x4ccaf4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041a850
add esp, 8
jmp 0x414f21
push 0x2002000
call fcn.00405434
add esp, 4
push 0x10006
call fcn.004054a2
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x414f63
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x414f5c
push 0x2002000
call fcn.00405434
add esp, 4
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f63
xor eax, eax
jmp 0x414f63
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414f68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414fbc
push 0x2002007
call fcn.00405434
add esp, 4
push 0x10001
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x415055
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415013
push 0x2002007
call fcn.00405434
add esp, 4
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x415055
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41504e
push 0x2002007
call fcn.00405434
add esp, 4
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x415055
xor eax, eax
jmp 0x415055
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41505a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4150ae
push 0x2002007
call fcn.00405434
add esp, 4
push 0x10001
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x41514d
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41510b
cmp dword [ebp - 4], 2
je 0x41510b
cmp dword [ebp - 4], 3
je 0x41510b
push 0x2002007
call fcn.00405434
add esp, 4
push 0x10004
call fcn.004054a2
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x41514d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415146
push 0x2002007
call fcn.00405434
add esp, 4
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x41514d
xor eax, eax
jmp 0x41514d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415152
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.0041b6ac
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x4ccaf8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x4151d2
push 0x10001
call fcn.004054a2
add esp, 4
push 0x2002012
call fcn.00405434
add esp, 4
mov eax, 0xffffffff
jmp 0x4153d0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x4ccb30
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x415239
push 0x10006
call fcn.004054a2
add esp, 4
push 0x2002012
call fcn.00405434
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x4153d0
mov eax, dword [ebp - 0x810]
mov al, byte [ebp + eax - 0x2f28]
and eax, 0xff
test eax, eax
je 0x41530e
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.0041af41
add esp, 4
push 0x4ccb34
lea eax, [ebp - 0x808]
push eax
call fcn.0041acc0
add esp, 8
test eax, eax
jne 0x4152e4
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041a850
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041a7d8
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.0041a7d8
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x415239
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x4ccb40
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x415385
push 0x10006
call fcn.004054a2
add esp, 4
push 0x2002012
call fcn.00405434
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x4153d0
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x4153c9
push 0x10002
call fcn.004054a2
add esp, 4
push 0x2002012
call fcn.00405434
add esp, 4
mov eax, 0xffffffff
jmp 0x4153d0
xor eax, eax
jmp 0x4153d0
pop edi
pop esi
pop ebx
leave
ret