joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424683
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x462f17
call fcn.0043c274
sub esp, 0x23c
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x246]
mov word [ebp - 0x248], si
mov dword [ebp - 0x14], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x10], esi
test byte [ebp + 0xf], 0x80
push 1
mov eax, 0x20019
pop edi
mov dword [ebp - 4], edi
je 0x4246cf
and byte [ebp + 0xf], 0x7f
mov eax, 0x20119
lea ecx, [ebp - 0x10]
push ecx
push eax
push esi
push 0x479910
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424716
cmp dword [ebp + 0xc], edi
mov dword [ebp - 0x18], 0x208
mov eax, 0x4798f0
je 0x4246ff
mov eax, 0x4798d0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x248]
push ecx
push esi
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
lea eax, [ebp - 0x248]
mov ebx, 0x468114
mov edi, 0x46810c
test eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x248]
jne 0x42473c
mov eax, 0x47e390
lea ecx, [ebp + 0xf]
push esi
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00401779
push 0x4764a4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004247a5
mov esi, dword [ebp + 8]
push 0
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 0x20], edi
call fcn.00401cec
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0040125c
cmp dword [ebp - 0x10], 0
pop ebx
je 0x424795
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x424795
push dword [ebp - 0x10]
call eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x424dd8
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x250
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x424e4f
mov eax, dword [esi + 8]
mov ebx, 0x4675fc
test eax, eax
jne 0x424df7
mov eax, ebx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x424e4f
mov eax, dword [esi + 8]
mov ecx, ebx
test eax, eax
je 0x424e15
mov ecx, eax
mov eax, dword [esi + 8]
push edi
test eax, eax
mov edi, ebx
je 0x424e21
mov edi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [esi + 8]
pop edi
test esi, esi
jne 0x424e3c
mov esi, ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x424e4f
push ebp
call eax
pop esi
pop ebp
pop ebx
add esp, 0x250
ret
Function at 0x4251b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [ebx], esi
mov dword [eax], esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
je 0x425249
push edi
call fcn.0043da25
push edi
push esi
push eax
mov dword [ebp + 0xc], eax
call fcn.0043d1f0
add esp, 0x10
push dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x425240
lea eax, [ebp - 0x3c]
push 0x34
mov dword [ebp + 8], eax
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0043d1f0
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp + 8]
push eax
push 0x4764a4
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x425240
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
push dword [ebp + 0xc]
call fcn.0043d93c
pop ecx
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 0xc
Function at 0x4277e9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x427919
cmp byte [ebp + 0xc], bl
jne 0x42789d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esi + 1]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x427919
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
test eax, eax
je 0x42790f
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0043c620
mov eax, esp
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov word [eax], bx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 8]
call fcn.0043c64f
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.0042839b
push dword [ebp + 0xc]
jmp 0x4278fe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esi + 3]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x427919
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42790c
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0xc], esi
cmp word [esi], 0xfeff
jne 0x4278e8
lea eax, [esi + 2]
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
call fcn.0043c64f
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0042839b
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x42791b
push dword [ebp + 0xc]
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4281dc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 1], bl
je 0x42824b
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x408]
push 0x400
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 2
jb 0x42822e
movzx eax, byte [ebp - 0x408]
cmp eax, 0xffffffff
jne 0x42822e
movzx eax, byte [ebp - 0x407]
cmp eax, 0xfffffffe
jne 0x42822e
mov byte [ebp - 1], 1
jmp 0x42824b
xor eax, eax
cmp dword [ebp - 8], ebx
jbe 0x42824b
cmp byte [ebp - 1], bl
jne 0x42824b
cmp byte [ebp + eax - 0x408], bl
sete byte [ebp - 1]
inc eax
cmp eax, dword [ebp - 8]
jb 0x428235
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ebp - 1]
pop ebx
leave
ret 4
Function at 0x429a72
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x429a86
push 1
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x429aba
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.0043894f
test al, al
jne 0x429aed
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413ad9
lea eax, [ebp - 0x4c]
push 0x46c670
push eax
call fcn.0043c99a
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x429aed
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00413799
lea eax, [ebp - 0x48]
push 0x46c538
push eax
call fcn.0043c99a
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x429f77
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esp + 8], 0
je 0x429f93
mov ecx, esi
call fcn.00429f97
pop esi
ret 4

Function at 0x42ab9c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x463625
call fcn.0043c274
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov ebx, 0x467594
and dword [esi], 0
mov dword [esi + 4], eax
lea ecx, [esi + 8]
lea eax, [ebp - 0xd]
mov edi, 0x46758c
push 0
push eax
mov dword [ebp - 0x14], esi
mov dword [ecx], ebx
mov dword [ecx + 0x20], edi
call fcn.00401c77
and dword [ebp - 4], 0
lea ecx, [esi + 0x30]
lea eax, [ebp - 0xe]
push 0
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x20], edi
call fcn.00401c77
lea ecx, [esi + 0x58]
lea eax, [ebp - 0xd]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 0x20], edi
call fcn.00401c77
lea ecx, [esi + 0x80]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 0x20], edi
call fcn.00401c77
lea ecx, [esi + 0xa8]
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 3
mov dword [ecx], ebx
xor ebx, ebx
push ebx
push eax
mov dword [ecx + 0x20], edi
call fcn.00401c77
mov eax, dword [ebp + 8]
and byte [esi + 0xd8], bl
mov byte [ebp - 4], 4
lea edi, [eax + 4]
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x2c]
mov ecx, eax
call fcn.0040654a
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0x3c]
mov dword [ebp + 8], eax
call fcn.0040125c
cmp dword [ebp + 8], ebx
setne al
mov byte [esi + 0xd9], al
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
push esi
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 6
call fcn.0042acd6
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 7
call dword [eax + 0x2c]
mov al, byte [eax + 0x16]
lea ecx, [esi + 0x154]
push eax
push esi
call fcn.0042ae0b
push esi
lea ecx, [esi + 0x1c4]
mov byte [ebp - 4], 8
call fcn.0042ae84
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x230], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42ccf2
Capabilities:
Get common file path

Disassembly:
mov eax, 0x463933
call fcn.0043c274
sub esp, 0x64
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
lea eax, [ebp - 0xd]
push 0
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x468114
mov dword [ebp - 0x50], 0x46810c
call fcn.0040af35
push 1
pop edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 4], edi
jne 0x42ce0b
mov esi, 0x104
lea eax, [ebp - 0x20]
push esi
push eax
lea ecx, [ebp - 0x70]
call fcn.0042cf38
mov ecx, dword [eax]
mov byte [ebp - 4], 2
mov byte [eax + 4], 1
call fcn.00401e7b
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, eax
lea ecx, [ebp - 0x20]
neg ebx
sbb bl, bl
mov byte [ebp - 4], 1
inc bl
call fcn.00401aab
test bl, bl
je 0x42cd8a
lea ecx, [ebp - 0x3c]
call fcn.004047e6
lea eax, [ebp - 0x3c]
push 0x46a320
push eax
call fcn.0043c99a
mov eax, 0x479ca0
mov dword [ebp - 0x48], 0x467594
mov ecx, eax
mov dword [ebp - 0x28], 0x46758c
test ecx, ecx
jne 0x42cda8
mov eax, 0x47e390
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00401779
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x70]
push eax
mov byte [ebp - 4], 3
call fcn.0043070b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0040125c
push edi
push 0x4764a4
lea ecx, [ebp - 0x70]
call fcn.004247a5
mov ecx, dword [ebp + 8]
push eax
call 0x42cf0e
mov dword [ebp - 0x14], edi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.0040125c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
cmp dword [ebp + 0xc], 2
mov esi, 0x104
push esi
jne 0x42ceb7
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x70]
push eax
call fcn.0042cf38
mov ecx, dword [eax]
mov byte [ebp - 4], 4
mov byte [eax + 4], 1
call fcn.00401e7b
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, eax
lea ecx, [ebp - 0x20]
neg ebx
sbb bl, bl
mov byte [ebp - 4], 1
inc bl
call fcn.00401aab
test bl, bl
je 0x42ce6e
lea ecx, [ebp - 0x3c]
call fcn.004047e6
lea eax, [ebp - 0x3c]
push 0x46a320
push eax
call fcn.0043c99a
mov eax, 0x479c8c
mov dword [ebp - 0x48], 0x467594
mov ecx, eax
mov dword [ebp - 0x28], 0x46758c
test ecx, ecx
jne 0x42ce8c
mov eax, 0x47e390
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00401779
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x70]
push eax
mov byte [ebp - 4], 5
call fcn.0043070b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
jmp 0x42cdce
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x70]
push eax
call fcn.0042cf38
mov ecx, dword [eax]
mov byte [ebp - 4], 6
mov byte [eax + 4], 1
call fcn.00401e7b
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea ecx, [ebp - 0x20]
neg ebx
sbb bl, bl
mov byte [ebp - 4], 1
inc bl
call fcn.00401aab
test bl, bl
je 0x42cdd3
lea ecx, [ebp - 0x3c]
call fcn.004047e6
lea eax, [ebp - 0x3c]
push 0x46a320
push eax
call fcn.0043c99a
cmp dword [esp + 8], 0
push esi
mov esi, ecx
je 0x42cf25
mov dword [esi], 0x468114
mov dword [esi + 0x20], 0x46810c
push 0
mov ecx, esi
push dword [esp + 0xc]
call fcn.00401cec
mov eax, esi
pop esi
ret 8
Function at 0x42d15e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4639ea
call fcn.0043c274
sub esp, 0xf4
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 0x30]
mov dword [ebp - 4], esi
test bl, 0x10
je 0x42d1b0
lea ecx, [ebp + 8]
call fcn.00419a83
test al, al
je 0x42d1b0
push ebx
lea eax, [ebp + 8]
sub esp, 0x28
mov ecx, esp
mov dword [ebp + 0x30], esp
push 1
push eax
call fcn.00401717
call fcn.0042d413
add esp, 0x2c
mov bl, al
jmp 0x42d32d
sub esp, 0x28
lea eax, [ebp + 8]
mov dword [ebp - 0x10], esp
mov ecx, esp
push esi
push eax
mov dword [ecx], 0x467594
mov dword [ecx + 0x20], 0x46758c
call fcn.00401cec
call fcn.0042ff74
add esp, 0x28
cmp eax, 0xffffffff
je 0x42d1fd
test bl, 4
je 0x42d1e5
test al, 0x10
je 0x42d1f6
test bl, 8
je 0x42d32b
test al, 0x10
je 0x42d32b
mov bl, 1
jmp 0x42d32d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, eax
cmp esi, 2
je 0x42d33d
cmp esi, 3
je 0x42d33d
push 1
cmp esi, 5
pop ebx
jne 0x42d2b2
lea ecx, [ebp - 0x100]
call fcn.0042d384
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 8]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
push eax
call fcn.00401717
call fcn.0042fea8
add esp, 0x2c
cmp eax, 0xffffffff
je 0x42d29f
test byte [ebp + 0x30], 4
je 0x42d26d
test byte [ebp - 0x100], 0x10
je 0x42d27e
test byte [ebp + 0x30], 8
je 0x42d27c
test byte [ebp - 0x100], 0x10
jne 0x42d27e
xor bl, bl
mov ecx, dword [sym.imp.KERNEL32.dll_FindClose]
test ecx, ecx
je 0x42d28b
push eax
call ecx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x100]
call fcn.0042d3dd
jmp 0x42d32d
call edi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x100]
mov esi, eax
call fcn.0042d3dd
test byte [ebp + 0x30], 0x20
je 0x42d32b
lea eax, [ebp + 8]
push 0
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x4675b8
mov dword [ebp - 0x1c], 0x4675b0
call fcn.00401cec
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], 0x467fa8
call fcn.00413a81
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.0042d35a
mov eax, dword [ebp - 0x84]
push 0x46c538
mov dword [ebp - 4], 3
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0x84], 0x467fa0
lea eax, [ebp - 0x84]
push eax
call fcn.0043c99a
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040125c
mov al, bl
jmp 0x42d34b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040125c
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x42e40c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x114], 0x114
and dword [eax], 0
lea eax, [ebp - 0x114]
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 1
jne 0x42e487
cmp dword [ebp - 0x10c], 0
je 0x42e47f
cmp dword [ebp - 0x10c], 0xa
je 0x42e46a
cmp dword [ebp - 0x10c], 0x5a
je 0x42e473
xor al, al
mov dword [esi], 0x80
jmp 0x42e4f8
call fcn.0042e7c3
test al, al
je 0x42e477
mov al, 1
jmp 0x42e45f
mov dword [esi], 0x40
jmp 0x42e4e1
mov dword [esi], 0x10
jmp 0x42e4e1
cmp dword [ebp - 0x104], 2
jne 0x42e4f6
mov eax, dword [ebp - 0x110]
sub eax, 4
je 0x42e4ee
mov ecx, dword [ebp - 0x10c]
dec eax
je 0x42e4b1
dec eax
je 0x42e4d7
xor al, al
mov dword [esi], 0x2000000
jmp 0x42e4f8
test ecx, ecx
jne 0x42e4bd
mov dword [esi], 0x100000
jmp 0x42e4e1
cmp ecx, 1
jne 0x42e4ca
mov dword [esi], 0x400000
jmp 0x42e4e1
cmp ecx, 2
jne 0x42e4d7
mov dword [esi], 0x800000
jmp 0x42e4e1
test ecx, ecx
jne 0x42e4e5
mov dword [esi], 0x1000000
mov al, 1
jmp 0x42e4f8
cmp ecx, 1
jne 0x42e4a7
mov al, cl
jmp 0x42e4a9
mov dword [esi], 0x10000
jmp 0x42e4e1
xor al, al
pop esi
leave
ret

Function at 0x42e6b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x479658
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42e6e7
push 0x47963c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42e6e7
call eax
jmp 0x42e7be
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
mov ebx, 0xf003f
push eax
push ebx
push 0
mov edi, VariantInit
push 0x479f1c
push edi
mov dword [ebp - 0xc], 0xa
call esi
test eax, eax
jne 0x42e733
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x47e390
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42e794
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
push 0
push 0x479ed0
push edi
call esi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x42e768
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x479ec0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x42e77c
cmp esi, ebx
je 0x42e77c
push dword [ebp - 8]
call esi
cmp edi, ebx
je 0x42e79c
cmp dword [ebp - 4], ebx
je 0x42e78e
cmp esi, ebx
je 0x42e78e
push dword [ebp - 4]
call esi
mov ax, 0x409
jmp 0x42e7be
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push 0x10
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0043e108
add esp, 0xc
cmp dword [ebp - 4], ebx
mov edi, eax
je 0x42e7bb
cmp esi, ebx
je 0x42e7bb
push dword [ebp - 4]
call esi
mov ax, di
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f58e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x463de4
call fcn.0043c274
sub esp, 0x214
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.0041c58b
mov edi, eax
cmp edi, esi
je 0x42f5d8
cmp dword [ebp - 0x10], esi
je 0x42f5d1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x42f675
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x42f649
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x10]
push eax
call fcn.0042f58e
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x42f636
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x42f5fb
cmp dword [ebp - 0x10], esi
je 0x42f644
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x42f675
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x42f65c
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x42f673
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42f686
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x463e10
call fcn.0043c274
sub esp, 0x3c
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x42f6ac
mov eax, 0x467588
push 0x20019
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0041c58b
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x42f74a
push esi
push edi
mov esi, 0x105
lea eax, [ebp + 0xb]
push 0
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0x467594
mov dword [ebp - 0x28], 0x46758c
call fcn.00401c77
lea eax, [ebp - 0x20]
push esi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00401822
mov ecx, dword [eax]
mov byte [ebp - 4], 3
mov byte [eax + 4], 1
call fcn.00401e7b
mov eax, dword [eax]
push esi
push eax
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [ebp - 0x20]
mov edi, eax
mov byte [ebp - 4], 2
call fcn.00401aab
test edi, edi
jne 0x42f737
mov ecx, dword [ebp + 0x34]
lea eax, [ebp - 0x48]
push eax
call fcn.00419e3f
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.0040125c
inc ebx
test edi, edi
je 0x42f6cf
pop edi
pop esi
mov eax, dword [ebp - 0x14]
test eax, eax
sete bl
cmp dword [ebp - 0x10], 0
mov dword [0x47e608], eax
je 0x42f76a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040125c
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42f785
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x463e63
call fcn.0043c274
sub esp, 0x44
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0xd]
push ebx
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 3
mov dword [ebp - 0x50], 0x467594
mov dword [ebp - 0x30], 0x46758c
call fcn.00401c77
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0x18]
mov byte [ebp - 4], 5
cmp eax, ebx
jne 0x42f7ce
mov eax, 0x467588
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ecx
push dword [ebp + 0x88]
push ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42f7f8
lea ecx, [ebp - 0x14]
call fcn.00408f03
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
push edi
cmp eax, ebx
mov edi, eax
jne 0x42f87d
mov eax, dword [ebp + 0x40]
cmp eax, ebx
jne 0x42f80b
mov eax, 0x467588
lea ecx, [ebp + 0x88]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea ecx, [ebp - 0x18]
push ebx
push ecx
push ebx
push eax
push dword [ebp - 0x14]
call esi
mov edi, eax
cmp edi, ebx
jne 0x42f87d
mov edi, dword [ebp + 0x40]
cmp edi, ebx
jne 0x42f836
mov edi, 0x467588
push dword [ebp + 0x88]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x50]
push eax
call fcn.00401822
mov ecx, dword [eax]
mov byte [ebp - 4], 6
mov byte [eax + 4], 1
call fcn.00401e7b
mov eax, dword [eax]
lea ecx, [ebp + 0x88]
push ecx
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push ebx
push edi
push dword [ebp - 0x14]
call esi
lea ecx, [ebp - 0x28]
mov edi, eax
mov byte [ebp - 4], 5
call fcn.00401aab
mov dword [0x47e608], edi
cmp edi, ebx
pop edi
lea eax, [ebp - 0x50]
je 0x42f88e
lea eax, [ebp + 0x60]
mov esi, dword [ebp + 8]
push ebx
push eax
mov ecx, esi
mov dword [esi], 0x467594
mov dword [esi + 0x20], 0x46758c
call fcn.00401cec
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x14], ebx
je 0x42f8bf
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 3
call fcn.0040125c
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 2
call fcn.0040125c
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 1
call fcn.0040125c
lea ecx, [ebp + 0x60]
mov byte [ebp - 4], bl
call fcn.0040125c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret