joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427a37
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00427a37
xor esi, esi
xor edi, edi
mov ecx, 0xd
push esi
dec ecx
jne 0x427a53
mov edx, dword [ebp + 8]
call fcn.0045b670
mov ecx, 1
mov eax, 8
call fcn.004527ff
lea ebx, [ebp - 0xa0]
mov ecx, 9
call fcn.0045b4a3
mov edx, dword [ebp + 8]
call fcn.0045b670
mov eax, 5
mov edx, dword [ebp + 8]
call fcn.0045b670
mov ecx, 1
mov edx, 0x1861138
call fcn.0045b687
xchg ecx, eax
call fcn.0045020d
add eax, ecx
mov ecx, eax
mov eax, 0x7fffffff
call fcn.004527ff
lea ebx, [ebp + 8]
call fcn.0045a876
mov edx, dword [ebp + 8]
call fcn.0045b670
call fcn.0045b655
mov esi, eax
push 0
lea ebx, [ebp - 0xa0]
call fcn.0045b45a
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
call fcn.004592f4
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ebx, esp
mov eax, dword [ebx]
call fcn.00456355
add esp, 4
fldcw word [ebp - 0x10]
fild dword [0x186b41c]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
call fcn.0045a779
ficomp dword [0x186b388]
fnstsw ax
sahf
jne 0x427cb9
fild dword [0x186b41c]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
call fcn.0045a762
fistp qword [ebp - 0x6c]
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xac], 1
jmp 0x427ca7
fild dword [0x186b41c]
fild dword [0x186b3c8]
mov eax, dword [ebp - 0xac]
call fcn.0045a848
fsubrp st(1)
fmulp st(1)
lea ebx, [ebp + 8]
call fcn.0045b77c
mov eax, ebx
call fcn.0045a848
faddp st(1)
fistp qword [ebp - 0x6c]
mov ebx, dword [ebp - 0x6c]
mov eax, dword [ebx]
mov dword [ebp - 0xb0], eax
push 0
lea ebx, [ebp - 0xa0]
call fcn.0045b45a
mov eax, dword [ebp - 0xb0]
call fcn.0045a848
call fcn.004592f4
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ebx, esp
mov eax, dword [ebx]
call fcn.00456355
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0xa0]
call fcn.0045b45a
lea ebx, [ebp - 0x50]
call fcn.0045a8f0
mov edx, 0x1861144
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x427c32
mov eax, dword [ebp - 0x50]
call fcn.00456355
push dword [ebp - 0xb0]
call fcn.0041a1fb
jmp 0x427ca1
mov edx, 0x1861154
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x427c67
mov eax, dword [ebp - 0x50]
call fcn.00456355
push dword [ebp - 0xb0]
call fcn.0041a311
jmp 0x427ca1
mov edx, 0x1861164
call fcn.0045b687
mov edx, dword [ebp - 0x50]
call fcn.0045b670
call fcn.0045abcf
jne 0x427c99
mov eax, dword [ebp - 0x50]
call fcn.00456355
push dword [ebp - 0xb0]
call fcn.0041a286
jmp 0x427ca1
mov eax, dword [ebp - 0x50]
call fcn.00456355
inc dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xb8]
jbe 0x427b70
call fcn.0045b4f9
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42c2f3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042c2f3
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0
mov ebx, str.AcpiData
call fcn.0045b45a
mov edx, 0x18617f8
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
call fcn.00423ea3
mov eax, 0x1f4
call fcn.00455620
push 1
call fcn.00423a8f
mov edx, 0x1860950
call fcn.0045b687
lea ebx, [ebp - 0xa4]
call fcn.0045a876
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
push 0x20019
push 0
lea ebx, [ebp - 0xa4]
call fcn.0045b77c
push ebx
fild qword [0x186adbc]
call fcn.0045a86f
push eax
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x42c413
push 0
push 0
mov ebx, str.AcpiData
call fcn.0045b45a
mov edx, 0x1861810
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp + 4]
call fcn.0045a938
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSaveKeyA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x42c407
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
call fcn.0045b4f9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42d06e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042d06e
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoSizeA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x42d0b9
jmp 0x42d2bb
mov eax, esi
call fcn.00455323
lea ebx, [ebp - 0xa4]
call fcn.0045a876
push 0
lea ebx, [ebp - 0xa4]
call fcn.0045b77c
push ebx
mov eax, esi
push eax
mov eax, edi
push eax
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoA]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x42d0f9
jmp 0x42d2bb
push 0
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
lea ebx, [ebp - 0xb4]
push ebx
mov edx, 0x1861958
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
lea ebx, [ebp - 0xa4]
call fcn.0045b77c
push ebx
call dword [sym.imp.VERSION.DLL_VerQueryValueA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x42d170
mov edx, 0x1861978
call fcn.0045b687
lea ebx, [ebp - 0xa8]
call fcn.0045a876
jmp 0x42d1ae
mov ebx, dword [ebp - 0xb4]
mov eax, dword [ebx]
movzx eax, ax
mov ecx, eax
mov eax, 4
call fcn.0044ed54
mov ebx, dword [ebp - 0xb4]
mov eax, dword [ebx]
shr eax, 0x10
mov ecx, eax
mov eax, 4
call fcn.0044ed54
call fcn.0045ab3a
lea ebx, [ebp - 0xa8]
call fcn.0045a876
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
lea ebx, [ebp - 0xb0]
push ebx
mov edx, 0x1861988
call fcn.0045b687
mov edx, dword [ebp - 0xa8]
call fcn.0045b670
call fcn.0045ab3a
mov edx, 0x18619b4
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp + 8]
call fcn.0045a938
lea ebx, [ebp - 0xa4]
call fcn.0045b77c
push ebx
call dword [sym.imp.VERSION.DLL_VerQueryValueA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
test eax, eax
je 0x42d236
mov ebx, dword [ebp - 0xb0]
call fcn.0045b45a
lea ebx, [ebp - 0xac]
call fcn.0045a876
mov edx, dword [ebp - 0xac]
call fcn.0045b670
mov edx, 0x185ea14
call fcn.0045b687
call fcn.0045a37c
lea ebx, [ebp - 0xac]
call fcn.0045a876
mov edx, dword [ebp - 0xac]
call fcn.0045b670
mov edx, 0x185fca0
call fcn.0045b687
call fcn.0045a37c
lea ebx, [ebp - 0xac]
call fcn.0045a876
mov edx, dword [ebp - 0xac]
call fcn.0045b670
mov edx, 0x185e804
call fcn.0045b687
call fcn.0045a37c
lea ebx, [ebp - 0xac]
call fcn.0045a876
mov edx, dword [ebp - 0xac]
call fcn.0045b670
lea ebx, [ebp - 0x98]
call fcn.0045a876
call fcn.0045b4f9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42d2dd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042d2dd
xor esi, esi
xor edi, edi
mov ecx, 0x8a
push esi
dec ecx
jne 0x42d2f9
call dword [sym.imp.USER32.DLL_GetForegroundWindow]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x42d312
jmp 0x42d476
lea ebx, [ebp - 0x1a4]
mov dword [ebx], edi
push ebx
push 0x3e8
push 3
lea ebx, [ebp - 0x1a0]
push ebx
push 0x104
push 0xd
mov eax, esi
push eax
call dword [sym.imp.USER32.DLL_SendMessageTimeoutA]
mov edi, dword [ebp - 0x1a4]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x1a0]
call fcn.0045b45a
call fcn.0045b655
test eax, eax
je 0x42d476
mov ebx, 0x185e14c
call fcn.0045b45a
lea ebx, [ebp - 0x1a0]
call fcn.0045b45a
call fcn.0045abcf
je 0x42d390
lea ebx, [ebp - 0x1a0]
call fcn.0045b45a
mov ebx, 0x185e14c
mov ecx, 0x104
call fcn.0045b4a3
push 0x104
lea ebx, [ebp - 0x2a8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.USER32.DLL_GetClassNameA]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x2a8]
call fcn.0045b45a
mov edx, 0x185fef0
call fcn.0045b687
call fcn.0045abcf
jne 0x42d412
lea ebx, [ebp - 0x2ac]
push ebx
mov eax, esi
push eax
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
fldcw word [ebp - 0x10]
test eax, eax
je 0x42d40d
push dword [ebp - 0x2ac]
call fcn.004236b7
call fcn.0045b69e
mov edx, 0x18619c8
call fcn.0045b687
call fcn.0045abcf
jne 0x42d40d
jmp 0x42d476
jmp 0x42d460
lea ebx, [ebp - 0x2a8]
call fcn.0045b45a
mov edx, 0x18619dc
call fcn.0045b687
call fcn.0045abcf
jne 0x42d460
lea ebx, [ebp - 0x1a0]
call fcn.0045b45a
mov edx, 0x185ff38
call fcn.0045b687
call fcn.0045abcf
jne 0x42d460
push 0
mov eax, esi
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x1a0]
call fcn.0045b45a
lea ebx, [ebp - 0x98]
call fcn.0045a876
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42da63
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042da63
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x42da7d
lea ebx, [ebp + 8]
call fcn.0045b45a
mov edx, 0x1860ca8
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x2e0]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp - 0x1dc]
push ebx
lea ebx, [ebp - 0x2e0]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x42dbd5
nop
fild dword [0x186aa28]
fild dword [0x186aa28]
mov eax, dword [ebp - 0x1dc]
call fcn.0045a848
call fcn.0045a6d3
fcompp
fnstsw ax
sahf
je 0x42db47
push 0
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
jmp 0x42dbae
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
mov edx, 0x185ea14
call fcn.0045b687
call fcn.0045abcf
je 0x42dbae
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
mov edx, 0x1860cb8
call fcn.0045b687
call fcn.0045abcf
je 0x42dbae
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
call fcn.0045ab3a
mov eax, 0x80000104
call fcn.00452ee2
call fcn.00425bd7
lea ebx, [ebp - 0x1dc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x42dae0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x42dbf2
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042dbf2
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x42dc0c
lea ebx, [ebp + 8]
call fcn.0045b45a
mov edx, 0x1860ca8
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x2e0]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp - 0x1dc]
push ebx
lea ebx, [ebp - 0x2e0]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x42ddb6
nop
nop
fild dword [0x186aa28]
fild dword [0x186aa28]
mov eax, dword [ebp - 0x1dc]
call fcn.0045a848
call fcn.0045a6d3
fcompp
fnstsw ax
sahf
je 0x42dd28
xor eax, eax
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
mov ecx, 1
mov edx, 0x185ea14
call fcn.0045b687
xchg ecx, eax
call fcn.0045020d
cmp eax, ecx
jne 0x42dd23
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
mov edx, 0x1861afc
call fcn.0045b687
call fcn.0045abcf
je 0x42dd23
push 0
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
jmp 0x42dd8f
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
mov edx, 0x185ea14
call fcn.0045b687
call fcn.0045abcf
je 0x42dd8f
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
mov edx, 0x1860cb8
call fcn.0045b687
call fcn.0045abcf
je 0x42dd8f
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
call fcn.0045ab3a
mov eax, 0x80000104
call fcn.00452ee2
call fcn.00425bd7
lea ebx, [ebp - 0x1dc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x42dc70
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x42ddd3
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042ddd3
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x42dded
lea ebx, [ebp + 8]
call fcn.0045b45a
mov edx, 0x1860ca8
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x2e0]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp - 0x1dc]
push ebx
lea ebx, [ebp - 0x2e0]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x42ded5
nop
fild dword [0x186aa28]
fild dword [0x186aa28]
mov eax, dword [ebp - 0x1dc]
call fcn.0045a848
call fcn.0045a6d3
fcompp
fnstsw ax
sahf
je 0x42deb2
push 0
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1b0]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x1dc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x42de50
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x431242
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431242
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov edx, 0x185e9a0
call fcn.0045b687
mov ebx, dword [ebp + 0x14]
call fcn.0045a876
mov ebx, dword [ebp + 0x18]
mov dword [ebx], 0
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0045b670
mov eax, 1
mov ecx, 1
xchg ecx, eax
call fcn.004527ff
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045abcf
jne 0x4312c8
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0045b670
mov ecx, 2
mov eax, 0x7fffffff
call fcn.004527ff
mov ebx, dword [ebp + 0xc]
call fcn.0045a876
lea ebx, [ebp - 0xa4]
push ebx
push 0x20019
push 0
mov ebx, dword [ebp + 0xc]
call fcn.0045b77c
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x43142a
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
push 0
push 0
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045b77c
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x43141b
mov eax, edi
mov ebx, eax
xor eax, eax
call fcn.004554b7
mov ebx, dword [ebp + 0x14]
call fcn.0045a876
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
mov ebx, dword [ebp + 0x14]
call fcn.0045b77c
push ebx
mov ebx, dword [ebp + 0x18]
push ebx
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045b77c
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebx]
call fcn.0045a848
fstp xword [ebp - 0x50]
fild dword [0x186aac4]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
je 0x4313c0
fild dword [0x186aac8]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
je 0x4313c0
fild dword [0x186aad0]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
jne 0x4313e6
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045b670
mov edx, 0x185e7e4
call fcn.0045b687
call fcn.00458e3c
mov ebx, dword [ebp + 0x14]
call fcn.0045a876
jmp 0x43141b
fild dword [0x186aacc]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
jne 0x43141b
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045b670
mov eax, 1
call fcn.0044f076
call fcn.004592f4
mov ebx, dword [ebp + 0x14]
call fcn.0045a876
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x43144d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043144d
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov edx, 0x185e9a0
call fcn.0045b687
mov ebx, dword [ebp + 0x14]
call fcn.0045a876
mov ebx, dword [ebp + 0x18]
mov dword [ebx], 0
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0045b670
mov eax, 1
mov ecx, 1
xchg ecx, eax
call fcn.004527ff
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045abcf
jne 0x4314d3
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0045b670
mov ecx, 2
mov eax, 0x7fffffff
call fcn.004527ff
mov ebx, dword [ebp + 0xc]
call fcn.0045a876
lea ebx, [ebp - 0xa4]
push ebx
fild dword [0x186b324]
fild dword [0x186aad8]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
mov ebx, dword [ebp + 0xc]
call fcn.0045b77c
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x431647
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
push 0
push 0
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045b77c
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x431638
mov eax, edi
mov ebx, eax
xor eax, eax
call fcn.004554b7
mov ebx, dword [ebp + 0x14]
call fcn.0045a876
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
mov ebx, dword [ebp + 0x14]
call fcn.0045b77c
push ebx
mov ebx, dword [ebp + 0x18]
push ebx
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045b77c
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebx]
call fcn.0045a848
fstp xword [ebp - 0x50]
fild dword [0x186aac4]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
je 0x4315dd
fild dword [0x186aac8]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
je 0x4315dd
fild dword [0x186aad0]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
jne 0x431603
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045b670
mov edx, 0x185e7e4
call fcn.0045b687
call fcn.00458e3c
mov ebx, dword [ebp + 0x14]
call fcn.0045a876
jmp 0x431638
fild dword [0x186aacc]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
jne 0x431638
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045b670
mov eax, 1
call fcn.0044f076
call fcn.004592f4
mov ebx, dword [ebp + 0x14]
call fcn.0045a876
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x43166a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043166a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
call fcn.0045b45a
call fcn.0045b655
push eax
mov ebx, dword [ebp + 0x14]
push ebx
push 1
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4316ee
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004316ee
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
call fcn.0045b45a
call fcn.0045b655
push eax
mov ebx, dword [ebp + 0x14]
push ebx
push 2
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x431775
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431775
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x9c]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186b324]
fild dword [0x186aadc]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
mov esi, dword [ebp - 0x98]
mov edi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
call fcn.0045b45a
call fcn.0045b655
push eax
mov ebx, dword [ebp + 0x14]
push ebx
push 1
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10