joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4757d4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4757eb
add esp, 0xfffffff0
call fcn.004041b8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00425ea0
mov eax, dword [0x4cf940]
cmp byte [eax], 0
jne 0x475818
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4cfc24]
cmp word [eax + 2], 0
jne 0x475832
mov eax, dword [0x4cfc24]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00477790
mov eax, dword [0x4cfd10]
cmp word [eax + 2], 0
jne 0x47584c
mov eax, dword [0x4cfd10]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004779a0
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x42a3e0]
call fcn.0042c0e4
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x477e24
mov dl, 1
mov eax, dword [0x41c95c]
call fcn.00403d38
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x41c95c]
call fcn.00403d38
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x42aebc]
call fcn.004337bc
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x475a28
mov eax, dword [0x4cfac4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00433bc0
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4780d4
mov dl, 1
mov eax, dword [0x41c95c]
call fcn.00403d38
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4cfac4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040cee4
test eax, eax
je 0x47595a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040cca0
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040cecc
test eax, eax
je 0x475972
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405c0c
push ebx
push 0x477160
call fcn.0046bd4c
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x4cf940]
cmp byte [eax], 0
jne 0x4759c3
mov eax, ebx
call fcn.00475b9c
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.004782fc
mov eax, ebx
call fcn.00478ec0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x475a20
call fcn.00404210
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475e70
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x475f12
cmp dword [ebx + 0x90], 0
jne 0x475f0c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x475dbc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x475f0c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x475ed2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x475f0c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.0041ef7c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x475ee1
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x476130
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4d5174]
cmp dword [eax + 0x170], 0
je 0x476295
test bl, bl
jne 0x4761e3
cmp dword [esi + 0x98], 0
jne 0x4761d8
mov eax, esi
call fcn.00478d10
push eax
push 0x47603c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x4761a9
mov eax, dword [0x4d5174]
cmp byte [eax + 0xcf], 0
je 0x4761a9
mov eax, dword [esi + 0xd4]
call fcn.0040703c
mov edi, eax
cmp edi, 0
jl 0x4761a9
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x476192
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4761d8
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.0041ef7c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4761b8
inc dword [esi + 0x98]
jmp 0x476295
cmp dword [esi + 0x98], 0
jle 0x476295
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x476295
cmp dword [esi + 0x40], 0
je 0x476240
mov eax, dword [0x4d5174]
cmp byte [eax + 0xcf], 0
je 0x476240
mov eax, dword [esi + 0xd4]
call fcn.0040703c
mov edi, eax
cmp edi, 0
jl 0x476240
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x476229
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x47626f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.0041ef7c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x47624f
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x46b754]
call fcn.004071fc
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x476e50
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x476ebb
cmp byte [ebx + 0xcf], 0
jne 0x476ebb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405b48
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x476ea8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x476ec8
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405a0c
jmp 0x476ec8
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405a0c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4784d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x47853e
mov eax, esi
call fcn.0045ec5c
test al, al
je 0x47853e
mov eax, dword [ebx + 0x80]
call fcn.0045e8b0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47853e
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x478532
push 0
mov eax, dword [ebx + 0x80]
call fcn.0045e8b0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.00455ef8
jmp 0x47853e
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.0047831c
pop esi
pop ebx
ret
Function at 0x483a90
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xfffffeec
xor ebx, ebx
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x483bd4
mov eax, dword [0x4cfee0]
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov eax, dword [0x4cfacc]
mov edx, dword [esp + 4]
mov dword [eax], edx
mov eax, dword [0x4cfd5c]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [0x4cfb60]
mov edx, dword [esp + 0xc]
mov dword [eax], edx
mov eax, dword [0x4cfaa0]
lea edx, [esp + 0x14]
mov ecx, 0x80
call fcn.00405c0c
mov eax, dword [0x4cfee0]
cmp dword [eax], 2
jne 0x483b8c
mov eax, dword [0x4cfacc]
cmp dword [eax], 3
jge 0x483b0c
mov bl, 7
jmp 0x483bd4
mov eax, dword [0x4cfacc]
cmp dword [eax], 3
jne 0x483b1d
mov bl, 8
jmp 0x483bd4
mov eax, dword [0x4cfacc]
cmp dword [eax], 4
jne 0x483b2e
mov bl, 9
jmp 0x483bd4
mov eax, dword [0x4cfacc]
cmp dword [eax], 5
jne 0x483b50
mov eax, dword [0x4cfd5c]
cmp dword [eax], 0
jne 0x483b49
mov bl, 0xa
jmp 0x483bd4
mov bl, 0xb
jmp 0x483bd4
mov eax, dword [0x4cfacc]
cmp dword [eax], 6
jne 0x483b88
mov eax, dword [0x4cfd5c]
cmp dword [eax], 0
jne 0x483b68
mov bl, 0xc
jmp 0x483bd4
mov eax, dword [0x4cfd5c]
cmp dword [eax], 1
jne 0x483b76
mov bl, 0xd
jmp 0x483bd4
mov eax, dword [0x4cfd5c]
cmp dword [eax], 2
jne 0x483b84
mov bl, 0xe
jmp 0x483bd4
mov bl, 0xf
jmp 0x483bd4
mov bl, 0xf
jmp 0x483bd4
mov eax, dword [0x4cfee0]
cmp dword [eax], 1
jne 0x483bd2
mov eax, dword [0x4cfacc]
cmp dword [eax], 4
jg 0x483bb2
mov eax, dword [0x4cfacc]
cmp dword [eax], 4
jge 0x483bae
mov bl, 2
jmp 0x483bd4
mov bl, 3
jmp 0x483bd4
mov eax, dword [0x4cfacc]
cmp dword [eax], 5
jne 0x483bc0
mov bl, 4
jmp 0x483bd4
mov eax, dword [0x4cfacc]
cmp dword [eax], 6
jne 0x483bce
mov bl, 5
jmp 0x483bd4
mov bl, 6
jmp 0x483bd4
mov bl, 1
mov eax, ebx
add esp, 0x114
pop ebx
ret
Function at 0x483d4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x483e61
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, esi
xor edx, edx
call fcn.00405a0c
test ebx, ebx
je 0x483e48
lea eax, [ebp - 0xc]
push eax
movzx edx, byte [ebp + 8]
mov eax, 0x20019
call fcn.00483d34
push eax
push 0
mov eax, ebx
call fcn.00405a98
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x483e48
xor eax, eax
push ebp
push 0x483e41
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 1
mov word [ebp - 0x816], 0
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x816]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405a98
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x483e2a
lea eax, [ebp - 0x81c]
lea edx, [ebp - 0x816]
call fcn.0040581c
mov edx, dword [ebp - 0x81c]
mov eax, esi
call fcn.00405c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483e48
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483e68
lea eax, [ebp - 0x81c]
call fcn.004056b8
ret
Function at 0x483e78
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x14]
mov byte [ebp - 9], 0
cmp dword [ebp - 8], 0
je 0x483fbe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
movzx edx, byte [ebp + 8]
mov eax, 0xf003f
call fcn.00483d34
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405a98
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x483fbe
xor eax, eax
push ebp
push 0x483fb7
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x483f05
push 0
push 0
push 1
push 0
mov eax, esi
call fcn.00405a98
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete byte [ebp - 9]
jmp 0x483f7d
mov dl, 1
mov eax, dword [0x4912d0]
call fcn.00491c18
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x483f76
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.00491d00
mov eax, dword [ebp - 0x18]
call fcn.00491d74
mov ebx, eax
add ebx, 2
push ebx
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.00491d2c
push eax
push 1
push 0
mov eax, esi
call fcn.00405a98
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483f7d
mov eax, dword [ebp - 0x18]
call fcn.00403d68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483fbe
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [ebp + 0xc], 0
je 0x483fa4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004836ec
movzx eax, byte [ebp - 9]
and al, byte [ebp + 0x10]
je 0x483fb6
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegFlushKey
ret
movzx eax, byte [ebp - 9]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x483fcc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
mov byte [ebp - 9], 0
cmp dword [ebp - 8], 0
je 0x4840a2
test ebx, ebx
je 0x4840a2
test esi, esi
jbe 0x4840a2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
movzx edx, byte [ebp + 8]
mov eax, 0xf003f
call fcn.00483d34
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405a98
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x4840a2
xor eax, eax
push ebp
push 0x48409b
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push ebx
push 3
push 0
mov eax, edi
call fcn.00405a98
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4840a2
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [ebp + 0xc], 0
je 0x484088
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004836ec
movzx eax, byte [ebp - 9]
and al, byte [ebp + 0x10]
je 0x48409a
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegFlushKey
ret
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4840b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
test ebx, ebx
je 0x484146
lea eax, [ebp - 0xc]
push eax
movzx edx, byte [ebp + 8]
mov eax, 0x20006
call fcn.00483d34
push eax
push 0
mov eax, ebx
call fcn.00405a98
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x484146
xor eax, eax
push ebp
push 0x48413f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405a98
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484146
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [ebp - 5]
and al, byte [ebp + 0xc]
je 0x48413e
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegFlushKey
ret
movzx eax, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x484154
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x814], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x484279
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, esi
xor edx, edx
call fcn.00405a0c
test ebx, ebx
je 0x484199
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x4841cc
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
push eax
movzx edx, byte [ebp + 8]
mov eax, 0x20019
call fcn.00483d34
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405a98
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x484260
xor eax, eax
push ebp
push 0x484259
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x400
mov word [ebp - 0x80e], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80e]
push eax
push ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_RegEnumValueW
test eax, eax
sete byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x484233
lea eax, [ebp - 0x814]
lea edx, [ebp - 0x80e]
call fcn.0040581c
mov edx, dword [ebp - 0x814]
mov eax, esi
call fcn.00405c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484260
cmp byte [ebp - 5], 0
jne 0x484258
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484280
lea eax, [ebp - 0x814]
call fcn.004056b8
ret
Function at 0x484290
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 0x15], cl
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x484489
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405a60
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405a60
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4842f2
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x4844a8
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405fc4
inc esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, esi
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004844ac
test al, al
jne 0x4842d9
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x48432f
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x4844a8
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405fc4
inc esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, esi
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00484154
test al, al
jne 0x484316
lea eax, [ebp - 0x1c]
push eax
movzx edx, byte [ebp + 8]
mov eax, 0x20006
call fcn.00483d34
push eax
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405a98
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x48446e
xor eax, eax
push ebp
push 0x484467
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4843d2
mov edx, dword [ebp - 8]
mov eax, 0x4844a8
call fcn.00411e04
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004061b8
lea eax, [ebp - 8]
push eax
lea edx, [ebx + 1]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.004061b8
mov eax, dword [ebp - 0xc]
call fcn.00405a98
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegDeleteValueW
cmp dword [ebp - 8], 0
jne 0x484389
jmp 0x484423
mov edx, dword [ebp - 4]
mov eax, 0x4844a8
call fcn.00411e04
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004061b8
lea eax, [ebp - 4]
push eax
lea edx, [ebx + 1]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 4]
call fcn.004061b8
mov eax, dword [ebp - 0xc]
call fcn.00405a98
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegDeleteKeyW
cmp dword [ebp - 4], 0
jne 0x4843da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48446e
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x14]
call fcn.00405a98
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
sete bl
mov eax, ebx
and al, byte [ebp - 0x15]
je 0x484466
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegFlushKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484490
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405a04
ret
Function at 0x4844ac
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x814], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4845d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, esi
xor edx, edx
call fcn.00405a0c
test ebx, ebx
je 0x4844f1
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x484524
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
push eax
movzx edx, byte [ebp + 8]
mov eax, 0x20019
call fcn.00483d34
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405a98
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4845b8
xor eax, eax
push ebp
push 0x4845b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x400
mov word [ebp - 0x80e], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80e]
push eax
push ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
sete byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x48458b
lea eax, [ebp - 0x814]
lea edx, [ebp - 0x80e]
call fcn.0040581c
mov edx, dword [ebp - 0x814]
mov eax, esi
call fcn.00405c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4845b8
cmp byte [ebp - 5], 0
jne 0x4845b0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4845d8
lea eax, [ebp - 0x814]
call fcn.004056b8
ret

Function at 0x484e64
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov edi, eax
or ebp, 0xffffffff
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
dec eax
mov esi, eax
test esi, esi
jl 0x484ea5
inc esi
xor ebx, ebx
mov eax, dword [edi + 4]
mov edx, ebx
call fcn.0041ef7c
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x484ea1
mov ebp, ebx
jmp 0x484ea5
inc ebx
dec esi
jne 0x484e81
mov eax, ebp
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x484f94
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call fcn.00405a98
mov esi, eax
push esi
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
jne 0x484fe5
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x48505d
mov eax, dword [ebp - 8]
call fcn.00484f58
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48505d
mov eax, dword [ebp - 0xc]
add eax, eax
call fcn.00484f58
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x485056
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x485038
call fcn.00404914
jmp 0x48505d
lea eax, [ebp - 4]
call fcn.00484f74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48505d
lea eax, [ebp - 0x10]
call fcn.00484f74
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret