joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429a0e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
push 0x4f3028
mov eax, dword [ebp + 8]
push eax
call fcn.0048ab80
add esp, 8
test eax, eax
jne 0x429aa8
mov ecx, dword [0x521864]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
lea eax, [ebp - 0x10c]
push eax
call fcn.0048a750
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10c]
push edx
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x429a9e
mov eax, dword [ebp + 0x10]
push eax
call fcn.0048a4f0
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x429aee
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0048a4f0
add esp, 4
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x42ae18
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [0x521a4c], 1
call fcn.004115c0
mov ecx, eax
call fcn.0042e3f0
mov dword [ebp - 4], eax
push 0
mov eax, dword [0x50570c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42ae86
push 0
mov ecx, dword [0x505760]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x505760]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x505760], 0
mov ecx, 0x505708
call fcn.0042e0e0
call fcn.0042d55d
xor edx, edx
mov dl, byte [0x521a05]
test edx, edx
je 0x42aea3
cmp dword [ebp - 4], 0
je 0x42aea3
xor eax, eax
mov al, byte [0x521a47]
test eax, eax
je 0x42aea5
jmp 0x42af02
mov dword [0x521a54], 0
push 0
push 0x8005
mov ecx, dword [ebp - 4]
call fcn.0042e2b0
and eax, 8
test eax, eax
jne 0x42af02
mov byte [0x505fc1], 0
mov ecx, dword [ebp - 8]
call fcn.0042cbd0
push 0x4f31b8
push 0x4f31bc
push 0x4f31c4
call fcn.00429a0e
add esp, 0xc
push 0x4f31d4
push 0x4f31d8
push 0x4f31e4
call fcn.00429a0e
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x42e9a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x42ff10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x10], 0x30
mov byte [ebp - 0xf], 0x31
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 0xc], 0x34
mov byte [ebp - 0xb], 0x35
mov byte [ebp - 0xa], 0x36
mov byte [ebp - 9], 0x37
mov byte [ebp - 8], 0x38
mov byte [ebp - 7], 0x39
mov byte [ebp - 6], 0x41
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0x43
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x45
mov byte [ebp - 1], 0x46
mov ecx, dword [ebp + 0x14]
push ecx
push 0x30
mov edx, dword [ebp + 0x10]
push edx
call fcn.0048a490
add esp, 0xc
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov byte [eax], 0
mov ecx, dword [ebp + 0x18]
and ecx, 0xff
test ecx, ecx
je 0x42ffda
mov dword [ebp - 0x14], 0
jmp 0x42ff96
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jge 0x42ffd8
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
and edx, 0xf
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp + edx - 0x10]
mov byte [ecx + eax*2 + 1], dl
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp + ecx - 0x10]
mov byte [eax + edx*2], cl
jmp 0x42ff8d
jmp 0x430043
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 0x14], edx
jmp 0x42ffee
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x430043
cmp dword [ebp - 0x18], 0
jle 0x430043
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
and edx, 0xf
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x18]
mov dl, byte [ebp + edx - 0x10]
mov byte [ecx], dl
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x18]
mov cl, byte [ebp + ecx - 0x10]
mov byte [eax], cl
jmp 0x42ffe5
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x437b63
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push str.SystemCurrentControlSetControlComputerNameComputerName
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x437bad
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.ComputerName
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x437bbe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x108], 4
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea eax, [ebp - 0x100]
push eax
call fcn.0048a660
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.0048a670
add esp, 8
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x100]
push ecx
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x437c4f
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push str.EnableDHCP
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x104]
mov esp, ebp
pop ebp
ret
Function at 0x438ffa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c68ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbe4
mov byte [ebp - 0xbd8], 1
lea ecx, [ebp - 0x10]
call fcn.00406f30
mov dword [ebp - 4], 0
push 0x521a80
lea ecx, [ebp - 0x10]
call fcn.004a342d
push 4
lea eax, [ebp - 0xbe4]
push eax
lea ecx, [ebp - 0x10]
call fcn.0049f64e
mov dword [ebp - 0xbec], eax
mov ecx, dword [ebp - 0xbec]
mov dword [ebp - 0xbf0], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xbf0]
push edx
lea ecx, [ebp - 0x10]
call fcn.004a33dd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbe4]
call fcn.004a32a4
lea ecx, [ebp - 0xbdc]
call fcn.00406f30
mov byte [ebp - 4], 2
cmp dword [0x521a40], 1
jne 0x4390bd
cmp dword [0x521a4c], 2
jne 0x4390bd
mov eax, dword [0x521864]
push eax
push 0x4f5208
lea ecx, [ebp - 0xbdc]
push ecx
call fcn.0049faa5
add esp, 0xc
jmp 0x4390db
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x521864]
push eax
push 0x4f521c
lea ecx, [ebp - 0xbdc]
push ecx
call fcn.0049faa5
add esp, 0x10
lea edx, [ebp - 0xbd4]
push edx
lea ecx, [ebp - 0xbdc]
call fcn.00406f50
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0xbcc], eax
cmp dword [ebp - 0xbcc], 0
jne 0x4391e1
push 5
push 0
lea eax, [ebp - 0xbc8]
push eax
call fcn.0048a490
add esp, 0xc
mov dword [ebp - 0xbe0], 0xbb8
mov dword [ebp - 0xbd0], 3
lea ecx, [ebp - 0xbe0]
push ecx
lea edx, [ebp - 0xbc8]
push edx
lea eax, [ebp - 0xbd0]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xbd4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsx eax, byte [ebp - 0xbc8]
cmp eax, 0x59
jne 0x439197
movsx ecx, byte [ebp - 0xbc7]
cmp ecx, 0x76
jne 0x439197
movsx edx, byte [ebp - 0xbc6]
cmp edx, 0x65
jne 0x439197
movsx eax, byte [ebp - 0xbc5]
cmp eax, 0x73
jne 0x439197
movsx ecx, byte [ebp - 0xbc4]
cmp ecx, 4
je 0x4391a0
mov byte [ebp - 0xbd8], 0
jmp 0x4391b8
push 0x440
lea edx, [ebp - 0xbc2]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0048a150
add esp, 0xc
movsx ecx, byte [ebp - 0xbc3]
cmp ecx, 1
jne 0x4391cc
mov edx, dword [ebp + 0xc]
mov byte [edx], 1
jmp 0x4391d2
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xbd4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4391e8
mov byte [ebp - 0xbd8], 0
mov dl, byte [ebp - 0xbd8]
mov byte [ebp - 0xbe8], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbdc]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004a32a4
mov al, byte [ebp - 0xbe8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43929d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c68d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7ec
lea ecx, [ebp - 0x10]
call fcn.00406f30
mov dword [ebp - 4], 0
push 0x521a80
lea ecx, [ebp - 0x10]
call fcn.004a342d
push 4
lea eax, [ebp - 0x7f0]
push eax
lea ecx, [ebp - 0x10]
call fcn.0049f64e
mov dword [ebp - 0x7f4], eax
mov ecx, dword [ebp - 0x7f4]
mov dword [ebp - 0x7f8], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x7f8]
push edx
lea ecx, [ebp - 0x10]
call fcn.004a33dd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7f0]
call fcn.004a32a4
lea ecx, [ebp - 0x7ec]
call fcn.00406f30
mov byte [ebp - 4], 2
cmp dword [0x521a40], 1
jne 0x439359
cmp dword [0x521a4c], 2
jne 0x439359
mov eax, dword [0x521864]
push eax
push 0x4f5248
lea ecx, [ebp - 0x7ec]
push ecx
call fcn.0049faa5
add esp, 0xc
jmp 0x439377
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x521864]
push eax
push 0x4f525c
lea ecx, [ebp - 0x7ec]
push ecx
call fcn.0049faa5
add esp, 0x10
lea edx, [ebp - 0x7e8]
push edx
lea ecx, [ebp - 0x7ec]
call fcn.00406f50
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0
jne 0x439432
mov byte [ebp - 0x7e0], 0x59
mov byte [ebp - 0x7df], 0x76
mov byte [ebp - 0x7de], 0x65
mov byte [ebp - 0x7dd], 0x73
mov byte [ebp - 0x7dc], 4
mov eax, dword [ebp + 0xc]
and eax, 0xff
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x7db], al
push 0x440
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x7da]
push edx
call fcn.0048a150
add esp, 0xc
push 0x446
lea eax, [ebp - 0x7e0]
push eax
push 3
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x7e8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x7e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7ec]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004a32a4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43f7ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c69bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7fc
mov byte [ebp - 0x7f0], 1
lea ecx, [ebp - 0x10]
call fcn.00406f30
mov dword [ebp - 4], 0
push 0x521a80
lea ecx, [ebp - 0x10]
call fcn.004a342d
push 4
lea eax, [ebp - 0x7fc]
push eax
lea ecx, [ebp - 0x10]
call fcn.0049f64e
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
mov dword [ebp - 0x808], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x808]
push edx
lea ecx, [ebp - 0x10]
call fcn.004a33dd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7fc]
call fcn.004a32a4
lea ecx, [ebp - 0x7f4]
call fcn.00406f30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x521864]
push ecx
push str.SoftwareRtWLan_sACMProfile_s
lea edx, [ebp - 0x7f4]
push edx
call fcn.0049faa5
add esp, 0x10
lea eax, [ebp - 0x7ec]
push eax
lea ecx, [ebp - 0x7f4]
call fcn.00406f50
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0
jne 0x43f906
push 0x7d0
push 0
lea ecx, [ebp - 0x7e0]
push ecx
call fcn.0048a490
add esp, 0xc
mov dword [ebp - 0x7f8], 0x7d0
mov dword [ebp - 0x7e8], 3
lea edx, [ebp - 0x7f8]
push edx
lea eax, [ebp - 0x7e0]
push eax
lea ecx, [ebp - 0x7e8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x7ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x7d0
lea ecx, [ebp - 0x7e0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048a150
add esp, 0xc
mov eax, dword [ebp - 0x7ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43f90d
mov byte [ebp - 0x7f0], 0
mov cl, byte [ebp - 0x7f0]
mov byte [ebp - 0x800], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7f4]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004a32a4
mov al, byte [ebp - 0x800]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x440371
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov byte [ebp - 0x14], 1
mov eax, dword [ebp + 8]
push eax
push str.LOCKED_STA_ADDRESS_d
lea ecx, [ebp - 0x14c]
push ecx
call fcn.0048a750
add esp, 0xc
mov edx, dword [0x521864]
push edx
push 0x4f5d08
lea eax, [ebp - 0x114]
push eax
call fcn.0048a750
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x114]
push edx
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 6
push 0
lea eax, [ebp - 8]
push eax
call fcn.0048a490
add esp, 0xc
mov dword [ebp - 0x118], 6
mov dword [ebp - 0xc], 3
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x440426
push 6
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048a150
add esp, 0xc
mov byte [ebp - 0x14], 1
jmp 0x44042a
mov byte [ebp - 0x14], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x4404af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov byte [ebp - 0x14], 1
mov eax, dword [ebp + 8]
push eax
push str.SET_DATA_RATE_STA_d
lea ecx, [ebp - 0x14c]
push ecx
call fcn.0048a750
add esp, 0xc
mov edx, dword [0x521864]
push edx
push 0x4f5d30
lea eax, [ebp - 0x114]
push eax
call fcn.0048a750
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x114]
push edx
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 8
push 0
lea eax, [ebp - 8]
push eax
call fcn.0048a490
add esp, 0xc
mov dword [ebp - 0x118], 8
mov dword [ebp - 0xc], 3
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x440564
push 8
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048a150
add esp, 0xc
mov byte [ebp - 0x14], 1
jmp 0x440568
mov byte [ebp - 0x14], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x44068f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6a00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x17c
mov byte [ebp - 0x28], 1
push 0x521a80
lea ecx, [ebp - 0x14]
call fcn.004a3312
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x14]
call fcn.0049f64e
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 0x188], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x188]
push edx
lea ecx, [ebp - 0x14]
call fcn.004a33dd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.004a32a4
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x521864]
push ecx
push 0x4f5d44
lea edx, [ebp - 0x130]
push edx
call fcn.0048a750
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x130]
push ecx
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x44076c
mov dword [ebp - 0x17c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004a32a4
mov eax, dword [ebp - 0x17c]
jmp 0x440885
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x16c], 0
cmp dword [ebp - 0x2c], 0
jne 0x440857
mov edx, dword [ebp - 0x170]
add edx, 1
mov dword [ebp - 0x170], edx
push 0x32
push 0
lea eax, [ebp - 0x168]
push eax
call fcn.0048a490
add esp, 0xc
mov dword [ebp - 0x174], 6
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x134], 0x32
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push eax
push 0
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x168]
push edx
mov eax, dword [ebp - 0x170]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x440852
lea edx, [ebp - 0x168]
cmp edx, 0x52135c
je 0x440852
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x440843
push 6
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x16c]
push edx
call fcn.0048a150
add esp, 0xc
mov eax, dword [ebp - 0x16c]
add eax, 6
mov dword [ebp - 0x16c], eax
jmp 0x44078e
cmp dword [ebp - 0x24], 0
je 0x440867
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x180], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004a32a4
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x440893
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6a45
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x178
mov dword [ebp - 0x17c], 0
lea ecx, [ebp - 0x170]
call fcn.00406f30
mov dword [ebp - 4], 1
mov byte [ebp - 0x5c], 1
push 0x521a80
lea ecx, [ebp - 0x14]
call fcn.004a3312
mov byte [ebp - 4], 2
push 4
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x14]
call fcn.0049f64e
mov dword [ebp - 0x180], eax
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x184], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x184]
push edx
lea ecx, [ebp - 0x14]
call fcn.004a33dd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x178]
call fcn.004a32a4
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x521864]
push ecx
push 0x4f5d64
lea edx, [ebp - 0x164]
push edx
call fcn.0048a750
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x164]
push ecx
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x4409a4
push 0x521360
mov ecx, dword [ebp + 8]
call fcn.004a3312
mov edx, dword [ebp - 0x17c]
or edx, 1
mov dword [ebp - 0x17c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004a32a4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x170]
call fcn.004a32a4
mov eax, dword [ebp + 8]
jmp 0x440a87
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x174], 6
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x168], 0x32
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x440a1a
lea ecx, [ebp - 0x58]
push ecx
call fcn.0048a4f0
add esp, 4
test eax, eax
jne 0x440a2c
push 0x521364
lea ecx, [ebp - 0x170]
call fcn.004a342d
jmp 0x440a3b
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x170]
call fcn.004a342d
cmp dword [ebp - 0x24], 0
je 0x440a4b
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x170]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004a3019
mov edx, dword [ebp - 0x17c]
or edx, 1
mov dword [ebp - 0x17c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004a32a4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x170]
call fcn.004a32a4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x440a95
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6a6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov byte [ebp - 0x20], 1
push 0x32
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.0048a490
add esp, 0xc
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0047ef9e
add esp, 8
push 0x521a80
lea ecx, [ebp - 0x10]
call fcn.004a3312
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x10]
call fcn.0049f64e
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x68], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x68]
push edx
lea ecx, [ebp - 0x10]
call fcn.004a33dd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.004a32a4
lea ecx, [ebp - 0x24]
call fcn.00406f30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x521864]
push ecx
push 0x4f5d84
lea edx, [ebp - 0x24]
push edx
call fcn.0049faa5
add esp, 0x10
lea eax, [ebp - 0x5c]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x24]
call fcn.00406f50
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x440b86
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00406f50
push eax
push reloc.RtlICS.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x440bd0
push 6
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0048a490
add esp, 0xc
push 6
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.0048a150
add esp, 0xc
push 6
lea edx, [ebp - 0x18]
push edx
push 3
push 0
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
cmp dword [ebp - 0x5c], 0
je 0x440be0
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004a32a4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret