joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe1088
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xe111c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe112c
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe10fa
movzx eax, bx
mov dword [ebp - 8], eax
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0xe1174
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe1123
cmp dword [ebp - 0xc], 0
je 0xe1116
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret

Function at 0xe1180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov word [ebp - 2], 0xd3d
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe124e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0
push 0
push 0xe1260
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 8], 0xd3d
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe12a8
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe122c
cmp dword [ebp - 8], 0
jbe 0xe120d
cmp dword [ebp - 8], 0x3e8
jb 0xe121c
cmp dword [ebp - 8], 0xffff
jae 0xe121c
cmp dword [ebp - 0xc], 4
je 0xe1224
mov word [ebp - 2], 0xd3d
jmp 0xe122c
mov ax, word [ebp - 8]
mov word [ebp - 2], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe1255
cmp dword [ebp - 0x18], 0
je 0xe1248
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
ret

Function at 0xe12b4
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xe1346
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe1354
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe1324
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0xe1388
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe134d
cmp dword [ebp - 0x10], 0
je 0xe1340
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0xe1398
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xe144c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0
push 0
push 0xe145c
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe1490
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe142a
cmp dword [ebp - 0xc], 4
jne 0xe142a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe1453
cmp dword [ebp - 0x14], 0
je 0xe1446
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret

Function at 0xe1be8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe1cc7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xe1caa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe1c88
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe1cd8
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe1c88
cmp dword [ebp - 0xc], 4
jne 0xe1c88
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe1cb1
cmp dword [ebp - 0x14], 0
je 0xe1ca4
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret
Function at 0xe1cfc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xe1dc9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xe1dac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.00025330
mov eax, dword [ebp - 0x14]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe1d8a
mov dword [ebp - 0xc], ebx
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0xe1dd8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe1db3
cmp dword [ebp - 0x10], 0
je 0xe1da6
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret

Function at 0xe1dfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe1edb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xe1ebe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe1e9c
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe1eec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe1e9c
cmp dword [ebp - 0x14], 4
jne 0xe1e9c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe1ec5
cmp dword [ebp - 8], 0
je 0xe1eb8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0xe1f18
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xe1fe5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xe1fc8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.00025330
mov eax, dword [ebp - 0x14]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe1fa6
mov dword [ebp - 8], ebx
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0xe1ff4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe1fcf
cmp dword [ebp - 0x10], 0
je 0xe1fc2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret

Function at 0xe2020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xe2124
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe20ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.00025330
mov eax, dword [ebp - 0x14]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0xe20dd
test bl, bl
je 0xe20a6
lea eax, [ebp - 0x10]
mov edx, 0xe213c
call fcn.00013cd4
jmp 0xe20b3
lea eax, [ebp - 0x10]
mov edx, 0xe2148
call fcn.00013cd4
mov eax, dword [ebp - 0x10]
call fcn.00013ecc
mov ebx, eax
inc ebx
push ebx
mov eax, dword [ebp - 0x10]
call fcn.00014090
push eax
push 1
push 0
push 0xe214c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe2106
cmp dword [ebp - 8], 0
je 0xe20f9
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0xe50c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe51a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xe5189
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe5167
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe51b4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe5167
cmp dword [ebp - 0x14], 4
jne 0xe5167
cmp dword [ebp - 0x10], 1
jne 0xe5167
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5190
cmp dword [ebp - 0xc], 0
je 0xe5183
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret

Function at 0xe51d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe5286
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0
push 0
push 0xe5294
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0xe5264
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe52c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe5264
cmp dword [ebp - 0x14], 4
jne 0xe5264
cmp dword [ebp - 0x18], 0
jne 0xe5264
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe528d
cmp dword [ebp - 8], 0
je 0xe5280
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0xe52d8
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0xe538a
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe539c
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe5368
test bl, bl
je 0xe5357
mov edx, 4
mov eax, 4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push edx
lea edx, [ebp - 0x10]
push edx
push eax
push 0
push 0xe53d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
jmp 0xe5368
push 0xe53d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5391
cmp dword [ebp - 0xc], 0
je 0xe5384
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret

Function at 0xe53e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe54c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xe54a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe5483
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe54d0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe5483
cmp dword [ebp - 0x14], 4
jne 0xe5483
cmp dword [ebp - 8], 1
jne 0xe5483
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe54ac
cmp dword [ebp - 0x10], 0
je 0xe549f
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0xe54f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0xe55e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0
push 0
push 0xe55f8
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0xe55c7
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe5628
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe55c7
cmp dword [ebp - 0xc], 4
jne 0xe55c7
cmp dword [ebp - 0x10], 1
jne 0xe55c7
mov byte [ebp - 1], 1
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe563c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe55c7
cmp dword [ebp - 0xc], 4
jne 0xe55c7
cmp dword [ebp - 0x10], 1
je 0xe55c7
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe55f0
cmp dword [ebp - 0x14], 0
je 0xe55e3
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret

Function at 0xe564c
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0xe5730
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe5740
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe570e
test bl, bl
je 0xe56e4
mov ebx, 4
mov esi, 4
mov dword [ebp - 0xc], 1
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0xe5770
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0xe5784
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0xe570e
push 0xe5784
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0xe5770
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jne 0xe570e
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5737
cmp dword [ebp - 0x10], 0
je 0xe572a
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0xe5794
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe5876
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe5859
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe5837
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xe5884
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe5837
cmp dword [ebp - 0x14], 4
jne 0xe5837
cmp dword [ebp - 0x10], 1
jne 0xe5837
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5860
cmp dword [ebp - 8], 0
je 0xe5853
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0xe58a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0xe5986
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xe5969
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe5947
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe5994
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe5947
cmp dword [ebp - 0x10], 4
jne 0xe5947
cmp dword [ebp - 0xc], 1
jne 0xe5947
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5970
cmp dword [ebp - 0x14], 0
je 0xe5963
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret
Function at 0xe59b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe5a5a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0xe5a68
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0xe5a38
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe5ab0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0xe5a38
cmp dword [ebp - 0x10], 4
jne 0xe5a38
cmp dword [ebp - 0x14], 1
jne 0xe5a38
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5a61
cmp dword [ebp - 8], 0
je 0xe5a54
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0xe5acc
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0xe5b8b
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe5b9c
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe5b69
test bl, bl
je 0xe5b4d
mov edx, 4
mov eax, 4
mov dword [ebp - 8], 1
push edx
lea edx, [ebp - 8]
push edx
push eax
push 0
push 0xe5be4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
jmp 0xe5b69
push 0xe5be4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jne 0xe5b69
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe5b92
cmp dword [ebp - 0xc], 0
je 0xe5b85
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret