joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce0b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x1c]
mov eax, edi
mov ebp, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ce0c0
sub eax, edx
cmp eax, 4
je 0x4ce0fb
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], str.Unexpected_section_tag_length
call fcn.0055909d
push 0x60e288
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], vtable.std::runtime_error.0
call fcn.00559aa1
push esi
mov esi, dword [esp + 0x1c]
push esi
push 4
push 1
push edi
call fcn.0055d5db
add esp, 0x10
cmp eax, 4
je 0x4ce140
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], str.Failed_to_write_section_tag
call fcn.0055909d
push 0x60e288
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], vtable.std::runtime_error.0
call fcn.00559aa1
mov edi, dword [esp + 0x24]
push ebx
mov ecx, edi
call fcn.004cde40
mov ebx, eax
mov ecx, ebx
and ecx, 0xff0000
mov edx, ebx
shr edx, 0x10
or ecx, edx
and eax, 0xff00
mov edx, ebx
shl edx, 0x10
or eax, edx
push esi
shl eax, 8
shr ecx, 8
or ecx, eax
push 4
lea eax, [esp + 0x28]
push 1
push eax
mov dword [esp + 0x30], ecx
call fcn.0055d5db
add esp, 0x10
cmp eax, 4
je 0x4ce1b9
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], str.Failed_to_write_section_length
call fcn.0055909d
push 0x60e288
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], vtable.std::runtime_error.0
call fcn.00559aa1
push edi
push esi
mov ecx, ebp
call fcn.004cdf80
test bl, 1
je 0x4ce20b
push esi
push 1
push 1
push 0x5d07a0
call fcn.0055d5db
add esp, 0x10
cmp eax, 1
je 0x4ce20b
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], str.Failed_to_write_section_padding
call fcn.0055909d
push 0x60e288
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], vtable.std::runtime_error.0
call fcn.00559aa1
pop ebx
pop esi
pop edi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x4ce250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b460
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x62d12c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4ce29b
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4ce3af
cmp dword [esi + 0xc], 0
je 0x4ce3af
call fcn.004cde40
mov ecx, dword [esi + 8]
mov edi, eax
and edi, 1
call fcn.004cde40
mov ecx, dword [esi + 0xc]
lea eax, [eax + edi + 0xc]
mov dword [ebp + 8], eax
call fcn.004cde40
mov ecx, dword [esi + 0xc]
mov edi, eax
and edi, 1
call fcn.004cde40
mov ecx, dword [ebp + 8]
add eax, edi
lea eax, [ecx + eax + 8]
mov edx, eax
mov ecx, eax
shr ecx, 0x10
and edx, 0xff0000
or edx, ecx
mov ecx, eax
and ecx, 0xff00
shl eax, 0x10
push ebx
or ecx, eax
push 4
shr edx, 8
shl ecx, 8
or edx, ecx
push 1
push str.FORM
mov dword [ebp - 0x14], edx
call fcn.0055d5db
add esp, 0x10
cmp eax, 4
je 0x4ce33e
mov eax, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push 4
lea edx, [ebp - 0x14]
push 1
push edx
call fcn.0055d5db
add esp, 0x10
cmp eax, 4
jne 0x4ce325
push ebx
push eax
push 1
push str.REDF
call fcn.0055d5db
add esp, 0x10
cmp eax, 4
jne 0x4ce325
mov eax, dword [esi + 8]
push eax
push str.EDMP
push ebx
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004ce0b0
mov ecx, dword [esi + 0xc]
push ecx
push str.EKEY
push ebx
mov ecx, esi
call fcn.004ce0b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ce3d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x59b4b2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62d12c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x2c], ebx
je 0x4ce429
mov dword [edi], 0x5d0830
mov dword [edi + 0x10], 0x5d0828
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [edi]
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov ebp, dword [edx + 4]
add ebp, edi
mov ecx, ebp
call fcn.0041fe50
lea esi, [edi + 0x18]
push 0x20
mov ecx, ebp
mov dword [ebp + 0x38], esi
mov dword [ebp + 0x3c], ebx
call fcn.00418a90
mov byte [ebp + 0x40], al
cmp dword [ebp + 0x38], ebx
jne 0x4ce475
mov eax, dword [ebp + 0xc]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, ebp
call fcn.00421750
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
mov ecx, esi
mov dword [esp + 0x24], 5
mov dword [edi + edx], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
call fcn.00416f10
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x636c44]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x4ce650
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x59b51c
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x62d12c]
xor eax, esp
mov dword [esp + 0x118], eax
push ebp
push esi
push edi
mov eax, dword [0x62d12c]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov edi, ecx
push 1
mov dword [esp + 0x24], edi
call fcn.004ce3d0
lea esi, [edi + 0xb8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov dword [esp + 0x134], 0
mov byte [esi], 0
lea eax, [esp + 0x24]
push eax
push 0x104
mov byte [esp + 0x13c], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4ce782
cmp eax, 0x104
ja 0x4ce782
lea ecx, [esp + 0x24]
push str.csavefs.
push ecx
call fcn.0058f7c3
add esp, 8
test eax, eax
je 0x4ce726
mov ecx, eax
lea ebp, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4ce700
sub ecx, ebp
push ecx
push eax
mov ecx, esi
call fcn.00422130
cmp dword [esi + 0x14], 0x10
jb 0x4ce71a
mov esi, dword [esi]
push 0x40
push 0x33
push esi
mov ecx, edi
call fcn.004cdf10
cmp dword [edi + 0x6c], 0
jne 0x4ce759
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], str.Failed_to_allocate_temporary_scratch_file
call fcn.0055909d
push 0x60e288
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.00559aa1
mov eax, edi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.00558b78
add esp, 0x128
ret
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], str.Failed_to_determine_systems_temp_directory
call fcn.0055909d
push 0x60e288
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.00559aa1
int3
Function at 0x4cefc0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x64
mov eax, dword [0x62d12c]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x70]
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
cmp ebx, 0x40
jl 0x4cf079
mov eax, ebx
shr eax, 6
mov dword [esp + 0xc], eax
neg eax
shl eax, 6
add ebx, eax
push edi
mov ecx, 0x10
mov esi, ebp
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x31]
mov esi, 0x10
lea esp, [esp]
movzx edx, byte [eax + 2]
mov cl, byte [eax - 1]
mov byte [eax - 1], dl
movzx edx, byte [eax + 1]
mov byte [eax + 2], cl
mov cl, byte [eax]
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
dec esi
jne 0x4cf040
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
add ebp, 0x40
call fcn.004cea70
add esp, 4
dec dword [esp + 0x10]
jne 0x4cf023
pop edi
push 0x40
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.0055aed0
push ebx
lea edx, [esp + 0x3c]
push ebp
push edx
call fcn.005592a0
add esp, 0x18
mov byte [esp + ebx + 0x2c], 0x80
lea eax, [esp + 0x2d]
mov esi, 0x10
movzx edx, byte [eax + 2]
mov cl, byte [eax - 1]
mov byte [eax - 1], dl
movzx edx, byte [eax + 1]
mov byte [eax + 2], cl
mov cl, byte [eax]
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
dec esi
jne 0x4cf0a4
inc ebx
cmp ebx, 0x38
jle 0x4cf0e6
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call fcn.004cea70
push 0x40
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.0055aed0
add esp, 0x10
mov eax, dword [esp + 0x28]
mov edx, eax
add eax, eax
add eax, eax
lea ecx, [esp + 0x2c]
sar edx, 0x1d
add eax, eax
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], eax
call fcn.004cea70
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x24]
add esp, 4
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
inc eax
mov esi, 5
lea ebx, [ebx]
movzx edx, byte [eax + 2]
mov cl, byte [eax - 1]
mov byte [eax - 1], dl
movzx edx, byte [eax + 1]
mov byte [eax + 2], cl
mov cl, byte [eax]
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
dec esi
jne 0x4cf140
mov ecx, dword [esp + 0x6c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00558b78
add esp, 0x64
ret
Function at 0x4d30e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59b9a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x62d12c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x80
xor eax, eax
mov dword [esi + 0x14], eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x3c], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
call fcn.004d2c90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x4dc3c0
Capabilities:
Hash data using sha256

Disassembly:
push ecx
cmp dword [esp + 8], 0
jne 0x4dc3cc
xor eax, eax
pop ecx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
lea ebp, [ebx + 0x6c]
mov ecx, 8
mov esi, ebx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x20]
push ecx
lea edi, [ebx + 0x8c]
push edi
call fcn.005592a0
mov esi, dword [ebx + 0x60]
mov byte [esi + ebx + 0x8c], 0x80
add esi, 1
mov edx, 0x40
sub edx, esi
push edx
lea eax, [esi + ebx + 0x8c]
push 0
push eax
call fcn.0055aed0
add esp, 0x18
cmp esi, 0x38
jbe 0x4dc432
push edi
push ebp
call fcn.004dbd30
push 0x40
push 0
push edi
call fcn.0055aed0
add esp, 0x14
mov ecx, dword [ebx + 0x64]
lea edx, [esp + 0xc]
shr ecx, 0x1d
lea eax, [ebx + 0xc4]
push edx
mov edi, 1
mov dword [esp + 0x10], ecx
call fcn.004dc370
mov eax, dword [ebx + 0x64]
add eax, eax
add eax, eax
add eax, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebx + 0xc8]
push ecx
call fcn.004dc370
lea eax, [ebx + 0x8c]
push eax
push ebp
call fcn.004dbd30
mov edi, dword [ebx + 0x68]
mov eax, dword [esp + 0x24]
neg edi
sbb edi, edi
push ebp
add edi, 8
call fcn.004dc370
xor eax, eax
add esp, 0x14
cmp dword [esp + 0x18], eax
je 0x4dc4b8
cmp dword [ebx + 0x68], eax
mov esi, 0x5d3e80
jne 0x4dc4a9
mov esi, 0x5d3ea0
mov ecx, 8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x4e2840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x224], 2
jne 0x4e2857
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x4e2680
push 0
push 0
call fcn.0055b93d
add esp, 0x18
mov dword [esi + 0x478], eax
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e41e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x62d12c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x40c]
push edx
push 0x20019
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e4322
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4e4322
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
xor esi, esi
mov edi, 0x200
mov eax, dword [ebp - 0x40c]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x204]
push edx
push esi
push eax
mov dword [ebp - 0x408], edi
call ebx
inc esi
test eax, eax
jne 0x4e42a1
mov edx, dword [ebp - 0x40c]
lea ecx, [ebp - 0x204]
push ecx
push edx
mov eax, ecx
mov ecx, dword [ebp - 0x410]
push eax
push ecx
call fcn.004e41e0
add esp, 0x10
test eax, eax
je 0x4e4252
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor esi, esi
lea esp, [esp]
lea edx, [ebp - 0x408]
push edx
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x418]
push ecx
mov ecx, dword [ebp - 0x40c]
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x404]
push eax
push esi
push ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x408], edi
call ebx
inc esi
test eax, eax
jne 0x4e431f
mov edx, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x418]
push edx
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x410]
push ecx
push 0
lea edx, [ebp - 0x404]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4e42b0
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00558b78
mov esp, ebp
pop ebp
ret
Function at 0x4e4460
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x62d12c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], ecx
xor edi, edi
mov bl, 1
mov edi, edi
lea edx, [ebp - 0x118]
push edx
mov edx, dword [esi + 8]
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x104]
push ecx
push edi
push edx
mov dword [ebp - 0x110], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edx, eax
inc edi
test edx, edx
jne 0x4e44e7
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push esi
call dword [ebp - 0x108]
mov bl, al
add esp, 0xc
test bl, bl
jne 0x4e4490
jmp 0x4e44f3
cmp edx, 0x103
je 0x4e44f3
test bl, bl
jne 0x4e44f5
xor edx, edx
push edx
mov ecx, esi
call fcn.004e4340
mov ecx, dword [ebp - 4]
test edx, edx
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.00558b78
mov esp, ebp
pop ebp
ret 8

Function at 0x4e4520
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x62d12c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
mov ebx, ecx
mov ecx, dword [ebx + 8]
push edi
push ecx
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edx, eax
cmp edx, edi
jne 0x4e45b8
mov eax, dword [ebp - 0xc]
inc eax
mov byte [ebp - 5], 1
call fcn.0055b590
mov esi, esp
mov edx, dword [ebp - 0xc]
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x10]
push ecx
inc edx
push esi
mov dword [ebp - 0x10], edx
mov edx, dword [ebx + 8]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edx, eax
inc edi
test edx, edx
jne 0x4e45a8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
push esi
push ebx
call dword [ebp + 8]
add esp, 0x10
mov byte [ebp - 5], al
test al, al
jne 0x4e4567
jmp 0x4e45b6
cmp edx, 0x103
je 0x4e45b6
cmp byte [ebp - 5], 0
jne 0x4e45b8
xor edx, edx
push edx
mov ecx, ebx
call fcn.004e4340
test edx, edx
sete al
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00558b78
mov esp, ebp
pop ebp
ret 8
Function at 0x4e4e00
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c330
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x62d12c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 8]
push 0x20019
push 1
push eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.004e4a10
xor edi, edi
push 0x24
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
call fcn.00559a21
add esp, 4
cmp eax, edi
je 0x4e4f39
mov dword [ebp - 0x1c], eax
mov dword [eax], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], eax
lea edx, [ebp - 0x1c]
push edx
push 0x4e4d30
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.004e4460
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
cmp esi, eax
je 0x4e4eae
mov edi, 0x10
lea esp, [esp]
cmp dword [esi + 0x1c], edi
lea eax, [esi + 8]
jb 0x4e4e9a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x38]
call fcn.004e4e00
mov esi, dword [esi]
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jne 0x4e4e90
xor edi, edi
mov esi, dword [eax]
mov dword [eax], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
cmp esi, eax
je 0x4e4ee2
mov edi, dword [esi]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004e1e20
push esi
call fcn.00558723
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov esi, edi
cmp edi, eax
jne 0x4e4ec2
xor edi, edi
push eax
call fcn.00558723
add esp, 4
lea ecx, [ebp - 0x38]
call fcn.004e4860
mov ecx, dword [ebp + 8]
mov edx, dword [ebx + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, edi
je 0x4e4f23
push eax
mov ecx, ebx
call fcn.004e4340
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], edi
call fcn.0055909d
push 0x60e354
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 0x28], vtable.std::bad_alloc.0
call fcn.00559aa1
int3
Function at 0x4e5560
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x62d12c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4e5635
call fcn.0055b590
mov edi, esp
test edi, edi
je 0x4e5635
mov ecx, dword [ebp - 0xc]
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4e5635
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0x5c0144
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4e5635
cmp dword [ebp - 8], 0x34
jne 0x4e5635
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov word [edx], cx
movzx ecx, word [eax + 8]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
movzx ecx, word [eax + 0xe]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
movzx ecx, word [eax + 0xc]
mov edx, dword [ebp + 0x18]
mov word [edx], cx
mov al, byte [eax + 0x1c]
mov ecx, dword [ebp + 0x1c]
and al, 1
mov byte [ecx], al
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x4e561f
mov edx, dword [ebp + 0x24]
push 0x5d6aec
push 0x5be59c
push 0xffffffffffffffff
push edx
push eax
call fcn.00559bfd
add esp, 0x14
mov al, 1
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00558b78
mov esp, ebp
pop ebp
ret
xor al, al
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00558b78
mov esp, ebp
pop ebp
ret

Function at 0x4e5650
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x62d12c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x4e5725
call fcn.0055b590
mov edi, esp
test edi, edi
je 0x4e5725
mov ecx, dword [ebp - 0xc]
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4e5725
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0x5d6af8
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4e5725
cmp dword [ebp - 8], 0x34
jne 0x4e5725
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov word [edx], cx
movzx ecx, word [eax + 8]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
movzx ecx, word [eax + 0xe]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
movzx ecx, word [eax + 0xc]
mov edx, dword [ebp + 0x18]
mov word [edx], cx
mov al, byte [eax + 0x1c]
mov ecx, dword [ebp + 0x1c]
and al, 1
mov byte [ecx], al
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x4e570f
mov edx, dword [ebp + 0x24]
push 0x5d6aec
push 0x5e5740
push 0xffffffffffffffff
push edx
push eax
call fcn.0055abe8
add esp, 0x14
mov al, 1
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00558b78
mov esp, ebp
pop ebp
ret
xor al, al
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00558b78
mov esp, ebp
pop ebp
ret