joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b8fc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
call fcn.0042ae38
test eax, eax
jl 0x42b960
push esi
lea eax, [ebp - 4]
push eax
push 0x41d5ec
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x42b95a
cmp dword [ebp + 8], 0
push 3
je 0x42b93e
push 0x41d5e8
jmp 0x42b943
push 0x41d8b4
push 1
push 0
push 0x42b964
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call esi
push dword [ebp - 8]
call esi
pop esi
leave
ret 4

Function at 0x42b97c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
call fcn.0042ae38
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, 0x42ba28
mov ebx, 0x41d5e8
jl 0x42b9e5
lea eax, [ebp - 4]
push eax
push 0x42ba90
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42b9dc
cmp dword [ebp + 8], eax
push 3
je 0x42b9c9
push 0x41d8b4
jmp 0x42b9ca
push ebx
push 1
push eax
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x42ba40
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42ba1e
cmp dword [ebp + 8], eax
push 3
je 0x42ba0b
push 0x41d8b4
jmp 0x42ba0c
push ebx
push 1
push eax
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42c7a3
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x44348c
call fcn.004036d1
sub esp, 0x120
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
push ebx
push edi
mov dword [ebp - 0x10], eax
call fcn.004044a9
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x18], eax
jl 0x42c91f
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov dword [ebp - 0x18], 0x80004005
jne 0x42c7ef
cmp dword [ebp + 8], ebx
je 0x42c7ef
mov eax, 0x80070057
jmp 0x42c922
cmp dword [ebp + 0x10], ebx
jne 0x42c7fe
mov eax, 0x80004003
jmp 0x42c922
mov ecx, dword [ebp + 8]
cmp ecx, ebx
jbe 0x42c809
xor eax, eax
rep stosd dword es:[edi], eax
call dword [0x446f78]
call fcn.004046e1
test al, al
mov byte [ebp - 0x11], al
je 0x42c821
call dword [sym.imp.ole32.dll_CoRevertToSelf]
push esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov esi, 0x20019
push esi
push 0x41d828
push 0x80000002
lea ecx, [ebp - 0x1c]
call fcn.004206b7
test eax, eax
jne 0x42c901
mov edi, dword [ebp + 0x10]
push edi
push 0x41d878
lea ecx, [ebp - 0x1c]
call fcn.0042ac61
mov eax, dword [ebp + 8]
cmp eax, dword [edi]
jae 0x42c86c
mov dword [ebp - 0x18], 0x8007007a
jmp 0x42c901
mov dword [ebp + 0x10], ebx
mov byte [ebp - 4], 1
push esi
push 0x41d870
push dword [ebp - 0x1c]
lea ecx, [ebp + 0x10]
call fcn.004206b7
test eax, eax
jne 0x42c8f5
cmp dword [ebp + 8], eax
push 4
mov edi, 0x104
pop esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], esi
jbe 0x42c8ec
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x12c]
push eax
push ebx
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x42c8ec
call dword [0x446f78]
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
push eax
call fcn.004106d6
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + 0xc]
inc ebx
cmp ebx, dword [ebp + 8]
mov dword [edx + ecx*4], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
jb 0x42c89e
cmp ebx, dword [ebp + 8]
jne 0x42c8f5
and dword [ebp - 0x18], 0
and byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00420652
cmp byte [ebp - 0x11], 0
pop esi
je 0x42c913
push dword [ebp - 0x18]
call fcn.00404730
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00420652
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
pop edi
pop ebx
call fcn.004037c0
leave
ret 0xc
Function at 0x42c93d
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4434d4
call fcn.004036d1
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0x80004005
call dword [0x446f78]
mov dword [ebp - 0x24], eax
call fcn.004046e1
xor ebx, ebx
cmp al, bl
mov byte [ebp - 0xd], al
je 0x42c971
call dword [sym.imp.ole32.dll_CoRevertToSelf]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
push ebx
push ebx
mov edi, 0x20006
push edi
push ebx
push ebx
push 0x41d828
push 0x80000002
lea ecx, [ebp - 0x14]
call fcn.00420669
test eax, eax
jne 0x42ca4f
mov esi, 0x41d870
push esi
lea ecx, [ebp - 0x14]
call fcn.00421d18
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
push ebx
push ebx
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.00420669
test eax, eax
jne 0x42ca44
mov edi, dword [ebp + 8]
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push ebx
push 0x41d878
push dword [ebp - 0x14]
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor esi, esi
cmp edi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], esi
jbe 0x42ca44
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + esi*4]
cmp edi, ebx
jne 0x42c9fc
xor eax, eax
jmp 0x42ca21
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov eax, esp
push dword [ebp - 0x24]
push esi
push edi
push eax
call fcn.0040cd49
mov esi, dword [ebp - 0x20]
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.004206ec
test eax, eax
jne 0x42ca3d
inc esi
cmp esi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
jb 0x42c9ee
jmp 0x42ca44
mov dword [ebp - 0x18], 0x80004005
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00420652
cmp byte [ebp - 0xd], bl
je 0x42ca5f
push dword [ebp - 0x18]
call fcn.00404730
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00420652
mov eax, dword [ebp - 0x18]
lea esp, [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42cbb0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x44354c
call fcn.004036d1
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
push edi
mov dword [eax], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
push 0x20019
push 0x42cd14
push 0x80000002
lea ecx, [ebp - 0x14]
call fcn.004206b7
cmp eax, esi
mov ebx, 0xffff
mov edi, 0x80070000
jle 0x42cbfb
and eax, ebx
or eax, edi
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x42ccdf
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, esi
jle 0x42cc28
and eax, ebx
or eax, edi
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x42ccdf
mov eax, dword [ebp - 0x1c]
cmp eax, esi
jbe 0x42ccd8
shl eax, 4
push eax
call fcn.00403734
cmp eax, esi
pop ecx
mov dword [ebp - 0x24], eax
je 0x42cd09
mov eax, dword [ebp - 0x28]
inc eax
push eax
mov dword [ebp - 0x2c], eax
call fcn.00403734
mov edi, eax
cmp edi, esi
pop ecx
je 0x42ccbc
xor ebx, ebx
cmp dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
jbe 0x42ccab
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
inc eax
push esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push edi
push ebx
lea ecx, [ebp - 0x14]
call fcn.0042ac37
test eax, eax
jne 0x42cca5
push dword [ebp - 0x18]
push edi
call fcn.0042ade9
test eax, eax
jne 0x42cca5
inc dword [ebp - 0x20]
add dword [ebp - 0x18], 0x10
inc ebx
cmp ebx, dword [ebp - 0x1c]
jb 0x42cc77
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
push edi
mov dword [ecx], eax
call fcn.004036f0
pop ecx
jmp 0x42ccc3
mov dword [ebp - 0x10], 0x8007000e
mov eax, dword [ebp + 8]
cmp dword [eax], esi
jne 0x42ccff
push dword [ebp - 0x24]
call fcn.004036f0
cmp dword [ebp - 0x10], esi
pop ecx
jne 0x42ccdf
mov dword [ebp - 0x10], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00420652
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
jmp 0x42ccdf
mov dword [ebp - 0x10], 0x8007000e
jmp 0x42ccdf
Function at 0x42f437
Capabilities:
Get common file path

Disassembly:
mov eax, 0x443d6c
call fcn.004036d1
sub esp, 0x138
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov ebx, ecx
call dword [0x446f78]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push 0x12
push dword [ebx + 4]
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x42f525
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
push 0x1076
mov ecx, 0x446a48
call fcn.0040b0e4
xor eax, eax
push 8
pop ecx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 0x1c]
cmp edi, esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x144]
mov dword [ebp - 0x38], eax
jne 0x42f4c2
mov dword [ebp - 0x34], esi
jmp 0x42f4ec
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov eax, esp
push dword [ebp - 0x20]
push esi
push edi
push eax
call fcn.0040cd49
mov dword [ebp - 0x34], eax
xor esi, esi
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x30], 0x1000
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov edi, eax
cmp edi, esi
je 0x42f518
lea eax, [ebp - 0x144]
push eax
push 0x3f5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x42f562
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x42f562
cmp dword [ebp - 0x14], esi
je 0x42f54e
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x18]
cmp edi, esi
je 0x42f55c
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
lea esp, [ebp - 0x150]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
call fcn.004037c0
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4314a1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x4315a9
lea eax, [ebp + 0xc]
push eax
push 0x60019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, 0xffff
mov esi, 0x80070000
jle 0x4314dd
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jne 0x4315ae
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
xor ecx, ecx
cmp eax, ecx
jle 0x431500
and eax, edi
or eax, esi
mov ebx, eax
cmp ebx, ecx
jne 0x43159e
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jle 0x43152c
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jne 0x43159e
and dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, 4
and eax, 0xfffffffc
inc ebx
call fcn.0040366c
mov esi, esp
xor edi, edi
cmp esi, edi
je 0x43159e
mov eax, dword [ebp - 0xc]
cmp eax, edi
mov dword [ebp + 8], edi
jbe 0x431597
mov eax, dword [ebp - 8]
push edi
push edi
push edi
inc eax
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x43158c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call fcn.004314a1
test eax, eax
jne 0x43158c
inc dword [ebp - 4]
inc dword [ebp + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jb 0x431556
cmp dword [ebp - 4], eax
jne 0x43159e
xor ebx, ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4315ae
mov ebx, 0x80070057
mov eax, ebx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4315ba
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call dword [0x446f78]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
cmp dword [ebp + 0x10], edi
mov ebx, eax
je 0x4315fa
push dword [ebp + 0x10]
call esi
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov eax, esp
push ebx
push edi
push dword [ebp + 0x10]
push eax
call fcn.0040cd49
mov edi, eax
cmp dword [ebp + 0xc], 0
jne 0x431604
xor esi, esi
jmp 0x431629
push dword [ebp + 0xc]
call esi
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov eax, esp
push ebx
push esi
push dword [ebp + 0xc]
push eax
call fcn.0040cd49
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jle 0x43164e
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x431658
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 0xc], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x431695
and eax, edi
or eax, esi
cmp eax, ebx
jne 0x4316ea
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
jle 0x4316b9
and eax, edi
or eax, esi
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
jne 0x4316ea
cmp dword [ebp - 0xc], ebx
jne 0x4316ea
cmp dword [ebp - 0x10], ebx
jne 0x4316ea
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, ebx
jle 0x4316ed
and eax, edi
or eax, esi
jmp 0x4316ed
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x43175b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
jle 0x43178e
and eax, edi
or eax, esi
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x431861
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
jle 0x4317bb
and eax, edi
or eax, esi
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x431858
cmp dword [ebp + 0x10], ebx
mov edi, dword [ebp + 0x14]
je 0x431853
cmp dword [edi], ebx
je 0x431853
mov eax, dword [ebp - 0xc]
inc eax
push eax
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], eax
call fcn.00403734
mov esi, eax
cmp esi, ebx
pop ecx
je 0x431847
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x10], eax
mov eax, dword [edi]
cmp eax, dword [ebp - 4]
jb 0x431800
mov eax, dword [ebp - 4]
cmp dword [ebp + 0x14], eax
jae 0x43183e
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
inc eax
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x431839
push dword [ebp + 0x10]
push esi
call fcn.004316f4
test eax, eax
jne 0x431839
inc dword [ebp + 8]
add dword [ebp + 0x10], 0x10
inc dword [ebp + 0x14]
jmp 0x4317f6
push esi
call fcn.004036f0
pop ecx
jmp 0x43184e
mov dword [ebp + 0xc], 0x8007000e
mov eax, dword [ebp + 8]
jmp 0x431856
mov eax, dword [ebp - 4]
mov dword [edi], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x431d69
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call dword [0x446f78]
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp + 8], eax
je 0x431e3f
cmp dword [ebp + 0x10], eax
je 0x431e3f
xor ebx, ebx
cmp dword [0x4474d0], eax
ja 0x431da9
mov esi, dword [ebp + 0x10]
mov eax, esi
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
push dword [ebp + 0x14]
lea ecx, [ebp - 4]
push ecx
push eax
push 0x20006
push dword [ebp + 0xc]
lea edi, [ebx*4 + 0x4474c8]
push dword [ebp + 8]
push eax
push dword [edi]
call fcn.0040e2ac
mov esi, eax
test esi, esi
jne 0x431e1d
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov eax, esp
push dword [ebp - 8]
push esi
push dword [ebp + 0x10]
push eax
call fcn.0040cd49
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jle 0x431e12
and eax, 0xffff
or eax, 0x80070000
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call fcn.00431936
inc ebx
cmp ebx, dword [0x4474d0]
jb 0x431da7
jmp 0x431d9b
mov esi, 0x80070057
jmp 0x431d9b
Function at 0x43236d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x432475
lea eax, [ebp + 0xc]
push eax
push 0x60019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, 0xffff
mov esi, 0x80070000
jle 0x4323a9
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jne 0x43247a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
xor ecx, ecx
cmp eax, ecx
jle 0x4323cc
and eax, edi
or eax, esi
mov ebx, eax
cmp ebx, ecx
jne 0x43246a
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jle 0x4323f8
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jne 0x43246a
and dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, 4
and eax, 0xfffffffc
inc ebx
call fcn.0040366c
mov esi, esp
xor edi, edi
cmp esi, edi
je 0x43246a
mov eax, dword [ebp - 0xc]
cmp eax, edi
mov dword [ebp + 8], edi
jbe 0x432463
mov eax, dword [ebp - 8]
push edi
push edi
push edi
inc eax
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x432458
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call fcn.0043236d
test eax, eax
jne 0x432458
inc dword [ebp - 4]
inc dword [ebp + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jb 0x432422
cmp dword [ebp - 4], eax
jne 0x43246a
xor ebx, ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43247a
mov ebx, 0x80070057
mov eax, ebx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x432559
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call dword [0x446f78]
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0xc], eax
je 0x4326fb
push 0x41d9bc
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4326a6
push 0x43270c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43269b
lea ecx, [ebp - 8]
push ecx
push 1
push ebx
call eax
test eax, eax
jne 0x43269b
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
test ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x4325ca
and dword [ebp - 4], 0
jmp 0x4325f1
push ebx
call esi
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov eax, esp
push dword [ebp - 0xc]
push edi
push ebx
push eax
call fcn.0040cd49
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x43261e
push ebx
call esi
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov eax, esp
push dword [ebp - 0xc]
push esi
push ebx
push eax
call fcn.0040cd49
mov ebx, eax
mov eax, dword [ebp - 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432624
sub eax, edx
mov ecx, eax
mov eax, ebx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x432634
sub eax, esi
lea eax, [ecx + eax + 2]
push eax
call fcn.00403734
test eax, eax
pop ecx
mov dword [edi], eax
je 0x43269b
mov edx, ebx
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x432650
mov edi, dword [edi]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x43265d
mov eax, dword [ebp - 4]
mov esi, 0x4138f4
movsw word es:[edi], word [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x432671
sub eax, ecx
mov esi, ecx
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x432682
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
cmp dword [edi], ebx
jne 0x4326e9
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp + 8]
push eax
push ebx
mov dword [ebp + 8], ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4326e9
push dword [ebp + 8]
call fcn.00403734
cmp eax, ebx
pop ecx
mov dword [edi], eax
je 0x4326e9
lea ecx, [ebp + 8]
push ecx
push eax
call esi
test eax, eax
jne 0x4326e9
push dword [edi]
call fcn.004036f0
pop ecx
mov dword [edi], ebx
mov eax, dword [edi]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x432700
mov eax, 0x80070057
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 4