joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4131d4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040ce70
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41326f
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x42eea8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x41326f
cmp eax, 1
je 0x413290
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41326f
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x41323c
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x41326b
xor eax, eax
inc eax
jmp 0x4132af
cmp edi, eax
jae 0x413273
xor eax, eax
jmp 0x4132af
cmp eax, esi
jae 0x41327a
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x42eea8]
jmp 0x413293
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4136e1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x42f070], ebx
push esi
push edi
jne 0x413761
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41379c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x419b4c
push edi
call esi
test eax, eax
mov dword [0x42f070], eax
je 0x41379c
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x42f074], eax
call esi
cmp dword [0x42eea8], 2
mov dword [0x42f078], eax
jne 0x413761
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x42f080], eax
je 0x413761
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x42f07c], eax
mov eax, dword [0x42f07c]
test eax, eax
je 0x4137a6
call eax
test eax, eax
je 0x41378d
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x42f080]
test eax, eax
je 0x41378d
test byte [ebp - 8], 1
jne 0x4137a6
cmp dword [0x42eeb4], 4
jb 0x4137a0
or byte [ebp + 0x12], 0x20
jmp 0x4137c5
xor eax, eax
jmp 0x4137d5
or byte [ebp + 0x12], 4
jmp 0x4137c5
mov eax, dword [0x42f074]
test eax, eax
je 0x4137c5
call eax
mov ebx, eax
test ebx, ebx
je 0x4137c5
mov eax, dword [0x42f078]
test eax, eax
je 0x4137c5
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x42f070]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415bbc
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0040ce70
mov eax, dword [0x41c380]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00412ffb
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x415cef
push 2
push esi
push dword [ebp + 8]
call fcn.00412ffb
add esp, 0xc
cmp eax, ebx
je 0x415cef
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x415c8f
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0040c880
push 0x8000
push dword [ebp + 8]
call fcn.0041676e
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x415c45
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.00411af6
add esp, 0xc
cmp eax, 0xffffffff
je 0x415c65
sub edi, eax
test edi, edi
jg 0x415c3d
jmp 0x415c7d
call fcn.00411958
cmp dword [eax], 5
jne 0x415c7a
call fcn.0041194f
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.0041676e
pop ecx
pop ecx
jmp 0x415cd7
jge 0x415cd7
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00412ffb
push dword [ebp + 8]
call fcn.00414549
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x415cd7
call fcn.0041194f
mov dword [eax], 0xd
call fcn.00411958
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.00412ffb
add esp, 0xc
mov eax, esi
pop edi
jmp 0x415cf1
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0040c86c
leave
ret
Function at 0x40fdd0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47da30
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49ffb8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x49ffb8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov edi, dword [ebp + 8]
call fcn.0040f7b0
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, eax
test esi, esi
je 0x40ff0b
jmp 0x40fe30
mov cl, byte [esi + 0x2c]
test cl, cl
je 0x40ff0b
mov bl, byte [esi + 0x2d]
push ecx
push dword [esp + 0x1c]
mov ecx, esi
push dword [esp + 0x18]
call fcn.0040f890
mov ecx, esi
test al, al
jne 0x40ff5f
call fcn.0040f5c0
push esi
call fcn.0043d98b
add esp, 4
test bl, bl
jne 0x40ff89
cmp dword [0x4a1a34], 1
jl 0x40fef6
mov dword [esp + 0x1c], vtable.Log.0
call fcn.0041ddc0
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x24], esi
call ebx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x14], ecx
call fcn.0042f280
mov dword [esi + 0x18], eax
mov dword [esp + 0x40], 1
mov dword [esi + 8], 1
mov eax, dword [esi + 4]
test eax, eax
je 0x40fec8
add eax, 0x10
jmp 0x40feca
xor eax, eax
push edi
push ecx
push str.NamedPipeClient::CallHCNamedPipe_SendAndReceive_failed_on_reused_pipe__trying_a_new_one
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], 0xffffffff
call fcn.0041dee0
jmp 0x40fefc
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.0040f7b0
mov esi, eax
test esi, esi
jne 0x40fe30
cmp dword [0x4a1a34], 0
jl 0x40ff89
mov dword [esp + 0x10], vtable.Log.0
call fcn.0041ddc0
mov esi, eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], esi
call ebx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x14], ecx
call fcn.0042f280
mov dword [esi + 0x18], eax
mov dword [esp + 0x40], 0
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40ff68
add eax, 0x10
jmp 0x40ff6a
call fcn.0040f700
mov al, 1
jmp 0x40ff8b
xor eax, eax
push str.NamedPipeClient::CallHCNamedPipe_invalid_pipe
push eax
call fcn.00407740
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0xffffffff
call fcn.0041dee0
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
Function at 0x413bc0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e0c0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x49ffb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x413bf6
mov eax, dword [esi]
jmp 0x413bf8
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x413c00
mov ecx, dword [edi]
push 0xb
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x413cfb
cmp dword [0x4a1a34], 2
jl 0x413ce7
lea ecx, [ebp - 0x1c]
call fcn.0041de50
mov dword [ebp - 4], 0
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x413c47
add ebx, 0x10
jmp 0x413c49
xor ebx, ebx
lea ecx, [ebp - 0x34]
call fcn.00425470
mov dword [ebp - 0x14], eax
push str.FileUtils::MoveFile_from
push ebx
mov byte [ebp - 4], 1
call fcn.00407740
add esp, 8
cmp dword [edi + 0x14], 8
mov ebx, eax
jb 0x413c70
mov edi, dword [edi]
mov edx, edi
mov ecx, ebx
call fcn.0041d070
push str._to
push ebx
call fcn.00407740
add esp, 8
cmp dword [esi + 0x14], 8
mov edi, eax
jb 0x413c91
mov esi, dword [esi]
mov edx, esi
mov ecx, edi
call fcn.0041d070
push dword [ebp - 0x14]
push ecx
push str._failed_with_error
push edi
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
cmp dword [ebp - 0x20], 0x10
jb 0x413cc6
push dword [ebp - 0x34]
call fcn.0043d98b
add esp, 4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0041dee0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47dee8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edx, ecx
lea ecx, [ebp - 0x30]
call fcn.0041c500
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x413e04
mov eax, dword [eax]
push 0
push 0x8000000
push 2
push 0
push 7
push 0x40000000
push eax
call dword [0x4a3388]
cmp dword [ebp - 0x1c], 8
mov dword [esi + 4], eax
jb 0x413e31
push dword [ebp - 0x30]
call fcn.0043d98b
add esp, 4
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x413e5d
push 0
lea ecx, [ebp - 0x18]
push ecx
push 3
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0xbbef
mov byte [ebp - 0x12], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [esi + 4], 0xffffffff
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
Function at 0x4156d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ecx + 0x10], 0
push ebx
jne 0x4156e4
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
lea ecx, [ebp - 0x18]
call fcn.0041c500
cmp dword [eax + 0x14], 8
jb 0x4156f6
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp - 4], 8
jb 0x415713
push dword [ebp - 0x18]
call fcn.0043d98b
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47c9c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49ffb8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x49ffb8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x416694
cmp byte [ebx + 0x45], 0
je 0x416694
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4165a0
xor al, al
jmp 0x416696
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x4165e0
cmp dword [esp + 0x2c], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, dword [esp + 0x1c]
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x416621
dec eax
je 0x416625
sub eax, 2
je 0x41667b
xor bl, bl
jmp 0x41667d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x41665c
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.00440273
add esp, 0x10
cmp esi, eax
jne 0x41661d
cmp byte [ebx + 0x45], 0
je 0x41667b
test esi, esi
jne 0x4165e0
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.004161d0
jmp 0x4165e0
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x416690
push dword [esp + 0x18]
call fcn.0043d98b
add esp, 4
mov al, bl
jmp 0x416696
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
Function at 0x417520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e470
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov edx, edi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], eax
call fcn.0041c500
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x44]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00416ee0
add esp, 4
test al, al
sete bl
mov byte [ebp - 4], 0
cmp dword [ebp - 0x48], 8
jb 0x4175a5
push dword [ebp - 0x5c]
call fcn.0043d98b
add esp, 4
test bl, bl
jne 0x417653
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x34]
push ecx
push 0x20019
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push 0
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x417684
cmp dword [0x4a1a34], 3
jl 0x417653
lea ecx, [ebp - 0x40]
call fcn.0041de50
mov byte [ebp - 4], 2
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 3
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x417603
add eax, 0x10
jmp 0x417605
xor eax, eax
push 0x48e060
push ecx
push esi
push ecx
push 0x490054
push ecx
push edi
push ecx
push str.Failed_to_RegGetValue_
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0041dee0
xor bl, bl
cmp dword [ebp - 0x1c], 8
jb 0x417666
push dword [ebp - 0x30]
call fcn.0043d98b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
mov edx, esi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x18], 4
call fcn.0041c500
cmp dword [eax + 0x14], 8
jb 0x41769d
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
push ecx
push 0
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
setne bl
cmp dword [ebp - 0x48], 8
jb 0x4176ca
push dword [ebp - 0x5c]
call fcn.0043d98b
add esp, 4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4176f5
cmp dword [0x4a1a34], 3
jl 0x417653
lea ecx, [ebp - 0x40]
call fcn.0041de50
mov byte [ebp - 4], 3
jmp 0x4175ea
mov bl, 1
jmp 0x417655
Function at 0x417700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e427
mov eax, dword fs:[0]
push eax
mov eax, 0x10110
call fcn.00457320
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1001c], 7
mov dword [ebp - 0x10020], 0
mov word [ebp - 0x10030], ax
mov edx, ecx
lea ecx, [ebp - 0x10100]
mov dword [ebp - 4], eax
call fcn.0041c500
lea ecx, [ebp - 0x10030]
push ecx
lea edx, [ebp - 0x100e8]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00416ee0
add esp, 4
test al, al
sete bl
mov byte [ebp - 4], 0
cmp dword [ebp - 0x100ec], 8
jb 0x41779f
push dword [ebp - 0x10100]
call fcn.0043d98b
add esp, 4
test bl, bl
jne 0x417849
cmp dword [ebp - 0x1001c], 8
lea ecx, [ebp - 0x100e0]
push ecx
push 0x20019
lea eax, [ebp - 0x10030]
cmovae eax, dword [ebp - 0x10030]
push 0
push eax
push dword [ebp - 0x100e8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417849
mov edx, edi
lea ecx, [ebp - 0x10100]
mov dword [ebp - 0x10018], 0x10000
call fcn.0041c500
cmp dword [eax + 0x14], 8
jb 0x4177f9
mov eax, dword [eax]
lea ecx, [ebp - 0x10018]
push ecx
lea ecx, [ebp - 0x10014]
push ecx
lea ecx, [ebp - 0x100e4]
push ecx
push 0
push eax
push dword [ebp - 0x100e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
setne bl
cmp dword [ebp - 0x100ec], 8
jb 0x417839
push dword [ebp - 0x10100]
call fcn.0043d98b
add esp, 4
test bl, bl
je 0x417880
push dword [ebp - 0x100e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
cmp dword [ebp - 0x1001c], 8
jb 0x417862
push dword [ebp - 0x10030]
call fcn.0043d98b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x100e4]
cmp eax, 4
jne 0x4178a3
mov eax, dword [ebp - 0x10014]
push dword [ebp - 0x100e0]
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x41784b
cmp eax, 1
jne 0x41791f
push ecx
lea ecx, [ebp - 0x100dc]
call fcn.004179a0
lea eax, [ebp - 0x10014]
push eax
lea ecx, [ebp - 0x10100]
call fcn.004134f0
lea edx, [ebp - 0x10100]
lea ecx, [ebp - 0x10118]
mov byte [ebp - 4], 4
call fcn.0041c490
sub esp, 8
lea ecx, [ebp - 0x100dc]
push eax
mov byte [ebp - 4], 5
call fcn.00418a80
lea ecx, [ebp - 0x10118]
call fcn.00404080
lea ecx, [ebp - 0x10100]
mov byte [ebp - 4], 8
call fcn.0040be60
push esi
lea ecx, [ebp - 0x100dc]
call fcn.00418760
lea ecx, [ebp - 0x100dc]
call fcn.00417940
push dword [ebp - 0x100e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x41784b
Function at 0x417a30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e470
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov edx, edi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], eax
call fcn.0041c500
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x44]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00416ee0
add esp, 4
test al, al
sete bl
mov byte [ebp - 4], 0
cmp dword [ebp - 0x48], 8
jb 0x417ab5
push dword [ebp - 0x5c]
call fcn.0043d98b
add esp, 4
test bl, bl
jne 0x417b63
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x34]
push ecx
push 0x20019
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push 0
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x417b94
cmp dword [0x4a1a34], 3
jl 0x417b63
lea ecx, [ebp - 0x40]
call fcn.0041de50
mov byte [ebp - 4], 2
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 3
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x417b13
add eax, 0x10
jmp 0x417b15
xor eax, eax
push 0x48e060
push ecx
push esi
push ecx
push 0x490054
push ecx
push edi
push ecx
push str.Failed_to_RegGetValue_
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0041dee0
xor bl, bl
cmp dword [ebp - 0x1c], 8
jb 0x417b76
push dword [ebp - 0x30]
call fcn.0043d98b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret
mov edx, esi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x18], 8
call fcn.0041c500
cmp dword [eax + 0x14], 8
jb 0x417bad
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
push ecx
push 0
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
setne bl
cmp dword [ebp - 0x48], 8
jb 0x417bda
push dword [ebp - 0x5c]
call fcn.0043d98b
add esp, 4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x417c05
cmp dword [0x4a1a34], 3
jl 0x417b63
lea ecx, [ebp - 0x40]
call fcn.0041de50
mov byte [ebp - 4], 3
jmp 0x417afa
mov bl, 1
jmp 0x417b65
Function at 0x4181e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e658
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov eax, ecx
mov dword [ebp - 0x30], eax
mov edi, dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x50]
call fcn.0041c500
push dword [ebp + 0xc]
lea edx, [ebp - 0x2c]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00417070
add esp, 4
test al, al
sete bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x3c], 8
jb 0x418254
push dword [ebp - 0x50]
call fcn.0043d98b
add esp, 4
test bl, bl
je 0x41825f
xor al, al
jmp 0x4183a3
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0041c500
mov dword [ebp - 4], 1
cmp dword [ebp - 0x14], 8
mov eax, dword [edi + 0x10]
mov ebx, dword [ebp - 0x34]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
mov edx, ebx
lea ecx, [ebp - 0x50]
lea edi, [eax + eax]
call fcn.0041c500
cmp dword [eax + 0x14], 8
jb 0x418296
mov eax, dword [eax]
push edi
push esi
push 1
push 0
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x3c], 8
mov edi, eax
jb 0x4182b9
push dword [ebp - 0x50]
call fcn.0043d98b
add esp, 4
test edi, edi
je 0x418385
cmp dword [0x4a1a34], 0
jl 0x418381
lea ecx, [ebp - 0x38]
call fcn.0041de50
mov byte [ebp - 4], 2
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x4182f3
lea esi, [eax + 0x10]
jmp 0x4182f5
xor esi, esi
push 0x48e060
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
push 0x48dfb8
push ecx
push edi
push ecx
push str.__err_
push ecx
push ebx
push ecx
push 0x490054
push ecx
push dword [ebp - 0x30]
push ecx
push str.Failed_to_RegSetValueExW_
push esi
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.004185b0
add esp, 4
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
add esp, 4
push eax
call fcn.00407740
add esp, 8
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0041dee0
xor bl, bl
jmp 0x418390
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
cmp dword [ebp - 0x14], 8
jb 0x4183a1
push dword [ebp - 0x28]
call fcn.0043d98b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret