joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443be8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x443d8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40df80]
call fcn.00402d80
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004039e8
push 0
call sub.USER32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x443d63
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00433f9c
test al, al
je 0x443d56
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x443d9c
lea eax, [ebp - 0x254]
call fcn.004087e4
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x443d56
xor eax, eax
push ebp
push 0x443d4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x443dd4
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
test eax, eax
jne 0x443d38
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403c14
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x443d38
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403c14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443d56
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x443c59
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.00411a14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443d94
lea eax, [ebp - 0x260]
call fcn.004039e8
ret

Function at 0x444530
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4767ac]
cmp byte [eax + 0x8d], 0
jne 0x4445a1
cmp dword [0x4767e8], 0
jne 0x444562
call sub.KERNEL32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4444ec
push eax
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x4767e8], eax
cmp dword [0x4767e4], 0
jne 0x44457d
push 0
push 0
push 0
push 0
call sub.KERNEL32.dll_CreateEventA
mov dword [0x4767e4], eax
cmp dword [0x4767ec], 0
jne 0x4445a1
push esp
push 0
push 0
push 0x444490
push 0x3e8
push 0
call sub.KERNEL32.dll_CreateThread_1
mov dword [0x4767ec], eax
pop edx
ret
Function at 0x444698
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4446af
add esp, 0xfffffff0
call fcn.004030b0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00414d34
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40db04]
call fcn.00402d80
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x40db04]
call fcn.00402d80
mov dword [ebx + 0x90], eax
xor eax, eax
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x44], 0x80000018
mov dword [ebx + 0x60], 0x1f4
mov byte [ebx + 0x64], 1
xor eax, eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x85], 1
mov dl, 1
mov eax, dword [0x416ac0]
call fcn.0041dd18
mov esi, eax
mov dword [ebx + 0x80], esi
push 0x444820
mov eax, dword [0x47587c]
mov eax, dword [eax]
push eax
call sub.USER32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041e0bc
mov eax, dword [ebx + 0x80]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x44612c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47587c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040b610
test eax, eax
je 0x44479f
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408158
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040b638
test eax, eax
je 0x4447b3
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.dll_CharLowerA
lea eax, [ebx + 0x74]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403c14
mov eax, dword [0x475734]
cmp byte [eax], 0
jne 0x4447e4
mov eax, ebx
call fcn.0044490c
mov byte [ebx + 0x41], 1
mov byte [ebx + 0x42], 1
mov byte [ebx + 0x43], 1
mov byte [ebx + 0x86], 1
xor eax, eax
mov dword [ebx + 0x88], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x444816
call fcn.00403108
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x444b68
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4767ac]
cmp dword [eax + 0x24], 0
je 0x444bf8
cmp dword [ebx + 0x7c], 0
jne 0x444bf5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x444afc
call sub.USER32.dll_EnumWindows
mov eax, dword [ebx + 0x78]
cmp dword [eax + 8], 0
je 0x444bf5
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.dll_GetWindowLongA
test al, 8
je 0x444bc4
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x78]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x444bf5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x78]
call fcn.0040f300
push eax
call sub.USER32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x444bd0
inc dword [ebx + 0x7c]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x445548
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x44557d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403acc
jmp 0x445587
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.00403a80
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44645c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x446494
mov eax, esi
call fcn.0042fd20
test al, al
je 0x446494
mov eax, dword [ebx + 0x6c]
call fcn.0042f8f8
push eax
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x446494
push 0
mov eax, dword [ebx + 0x6c]
call fcn.0042f8f8
push eax
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x44ae28
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
test dl, dl
je 0x44ae36
add esp, 0xfffffff0
call fcn.004030b0
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00402d80
push 0x40
push 0x1000
push 0x800
push 0
call sub.KERNEL32.dll_VirtualAlloc_1
mov dword [esi + 4], eax
mov eax, esi
test bl, bl
je 0x44ae6e
call fcn.00403108
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4653b4
Capabilities:
Check os version
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xc4], ecx
test dl, dl
je 0x4653da
add esp, 0xfffffff0
call fcn.004030b0
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x465598
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00402d80
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.KERNEL32.dll_GetVersionExA
mov eax, dword [ebp - 0x8c]
sub eax, 1
jb 0x465420
je 0x46542c
dec eax
je 0x46547b
jmp 0x4654b5
mov dword [ebp - 5], 0x73323303
jmp 0x4654b5
mov byte [esi + 4], 1
and dword [ebp - 0x90], 0xffff
cmp dword [ebp - 0x98], 4
ja 0x465455
cmp dword [ebp - 0x98], 4
jne 0x465468
cmp dword [ebp - 0x94], 0xa
jb 0x465468
mov byte [esi + 7], 1
push esi
mov esi, 0x4655c0
lea edi, [ebp - 5]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4654b5
mov byte [esi + 6], 1
push esi
mov esi, 0x4655c4
lea edi, [ebp - 5]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4654b5
mov byte [esi + 5], 1
push esi
mov esi, 0x4655c8
lea edi, [ebp - 5]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [ebp - 0x98]
sub eax, 3
je 0x46549f
dec eax
je 0x4654a5
dec eax
je 0x4654ab
jmp 0x4654b1
mov byte [esi + 8], 1
jmp 0x4654b5
mov byte [esi + 9], 1
jmp 0x4654b5
mov byte [esi + 0xa], 1
jmp 0x4654b5
mov byte [esi + 0xa], 1
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 5]
mov dword [ebp - 0xec], eax
mov byte [ebp - 0xe8], 4
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xe4], eax
mov byte [ebp - 0xe0], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xdc], eax
mov byte [ebp - 0xd8], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0
lea eax, [ebp - 0x88]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 6
lea edx, [ebp - 0xec]
mov ecx, 4
mov eax, 0x4655d4
call fcn.0040884c
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.00407a80
mov edx, dword [ebp - 0xc0]
lea eax, [esi + 0xc]
call fcn.00403a3c
mov dword [ebp - 0xbc], 0x20
lea eax, [ebp - 0xbc]
push eax
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0xb4]
shr eax, 0x14
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0xb0]
shr eax, 0x14
mov dword [esi + 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46559f
lea eax, [ebp - 0xc4]
mov edx, 2
call fcn.00403a0c
ret
Function at 0x465748
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffcc
mov edi, eax
xor ebx, ebx
mov esi, 1
push esp
call sub.KERNEL32.dll_QueryPerformanceFrequency
test eax, eax
je 0x4657f8
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_QueryPerformanceCounter
mov eax, esi
cdq
push edx
push eax
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0040597c
add eax, dword [esp + 8]
adc edx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.00465744
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_QueryPerformanceCounter
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
cmp edx, dword [esp + 0x14]
jne 0x4657be
cmp eax, dword [esp + 0x10]
jb 0x46579e
jmp 0x4657c0
jl 0x46579e
call fcn.00465744
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, dword [esp + 0x18]
sbb edx, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
fild qword [esp + 0x28]
mov dword [esp + 0x30], esi
fild dword [esp + 0x30]
fdivp st(1)
fistp qword [edi]
wait
mov bl, 1
mov eax, ebx
add esp, 0x34
pop edi
pop esi
pop ebx
ret

Function at 0x465e18
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403e18
xor eax, eax
push ebp
push 0x465f0a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp dword [ebp - 4], 0
jne 0x465e63
lea eax, [ebx + 8]
mov edx, dword [ebx + 4]
call fcn.00403a3c
lea eax, [ebx + 0xc]
mov edx, 0x465f24
call fcn.00403a3c
jmp 0x465e8f
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x10]
call fcn.00407f50
mov edx, dword [ebp - 8]
lea eax, [ebx + 8]
call fcn.00403a3c
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x10]
call fcn.00407fe0
mov edx, dword [ebp - 8]
lea eax, [ebx + 0xc]
call fcn.00403a3c
push dword [ebx + 8]
push dword [ebx + 0xc]
push 0x465f34
lea eax, [ebx + 0x10]
mov edx, 3
call fcn.00403d24
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x10]
call fcn.00403e28
push eax
push 1
push 3
push 1
push 0xf01ff
mov eax, dword [ebx + 0xc]
call fcn.00403e28
mov edi, eax
push edi
push edi
mov eax, dword [ebx + 0x14]
push eax
call sub.ADVAPI32.dll_CreateServiceA
test eax, eax
jne 0x465ee7
call sub.KERNEL32.dll_GetLastError_1
mov esi, eax
jmp 0x465eed
push eax
call sub.ADVAPI32.dll_CloseServiceHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465f11
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a0c
ret
Function at 0x465f3c
Capabilities:
Start service

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
xor esi, esi
xor eax, eax
mov dword [esp], eax
push 0xf01ff
mov eax, dword [ebx + 0xc]
call fcn.00403e28
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.ADVAPI32.dll_OpenServiceA
mov ebx, eax
test ebx, ebx
je 0x465f7b
push esp
push 0
push ebx
call sub.ADVAPI32.dll_StartServiceA
test eax, eax
jne 0x465f82
call sub.KERNEL32.dll_GetLastError_1
mov esi, eax
jmp 0x465f82
call sub.KERNEL32.dll_GetLastError_1
mov esi, eax
test ebx, ebx
je 0x465f8c
push ebx
call sub.ADVAPI32.dll_CloseServiceHandle
mov eax, esi
pop edx
pop esi
pop ebx
ret

Function at 0x465f94
Capabilities:
Stop service

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, eax
xor esi, esi
push 0xf01ff
mov eax, dword [ebx + 0xc]
call fcn.00403e28
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.ADVAPI32.dll_OpenServiceA
mov ebx, eax
test ebx, ebx
je 0x465fd0
push esp
push 1
push ebx
call sub.ADVAPI32.dll_ControlService
test eax, eax
jne 0x465fd7
call sub.KERNEL32.dll_GetLastError_1
mov esi, eax
jmp 0x465fd7
call sub.KERNEL32.dll_GetLastError_1
mov esi, eax
test ebx, ebx
je 0x465fe1
push ebx
call sub.ADVAPI32.dll_CloseServiceHandle
mov eax, esi
add esp, 0x1c
pop esi
pop ebx
ret

Function at 0x465fec
Capabilities:
Delete service

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00465f94
xor esi, esi
push 0xf01ff
mov eax, dword [ebx + 0xc]
call fcn.00403e28
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.ADVAPI32.dll_OpenServiceA
mov ebx, eax
test ebx, ebx
je 0x466029
push ebx
call sub.ADVAPI32.dll_DeleteService
test eax, eax
jne 0x466030
call sub.KERNEL32.dll_GetLastError_1
mov esi, eax
jmp 0x466030
call sub.KERNEL32.dll_GetLastError_1
mov esi, eax
test ebx, ebx
je 0x46603a
push ebx
call sub.ADVAPI32.dll_CloseServiceHandle
mov eax, esi
pop esi
pop ebx
ret
Function at 0x466ff8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467161
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403a80
mov eax, dword [ebp - 0x10]
call fcn.00466c74
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x46704a
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403ea8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00467750
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x46711f
xor eax, eax
push ebp
push 0x467118
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00466ddc
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00467190
test al, al
je 0x4670f6
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403acc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4670f6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403e28
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
jne 0x4670f0
mov eax, dword [ebp - 0x14]
call fcn.00403e28
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403b9c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00466ff8
dec ebx
cmp ebx, 0xffffffff
jne 0x4670a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46711f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00466ddc
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403e28
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00466dc8
push eax
call sub.ADVAPI32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467168
lea eax, [ebp - 0x3c]
call fcn.004039e8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403a0c
ret

Function at 0x467190
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402ab0
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.ADVAPI32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x475b78]
cmp byte [edx + 8], 0
je 0x4671f4
mov edx, dword [0x475b70]
cmp dword [edx], 2
jne 0x4671f4
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x4671f8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4672b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00467190
test al, al
je 0x467292
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403acc
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x467292
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403e28
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00403e28
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403b9c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x46724b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4672b7
lea eax, [ebp - 0x2c]
call fcn.004039e8
lea eax, [ebp - 0xc]
call fcn.004039e8
ret

Function at 0x4672c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x467378
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00467190
test al, al
je 0x46735a
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403acc
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x46735a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403e28
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.ADVAPI32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00403e28
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403b9c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x467313
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46737f
lea eax, [ebp - 0x2c]
call fcn.004039e8
lea eax, [ebp - 0xc]
call fcn.004039e8
ret
Function at 0x4675ec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46767d
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00466c88
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403e28
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
je 0x467667
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x475968]
call fcn.004050c0
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x466a24]
call fcn.0040aa5c
call fcn.0040345c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467684
lea eax, [ebp - 0x10]
call fcn.004039e8
ret

Function at 0x467690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46772b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403e28
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
test eax, eax
je 0x467705
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x475b84]
call fcn.004050c0
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x466a24]
call fcn.0040aa5c
call fcn.0040345c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00466cb8
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467732
lea eax, [ebp - 0x10]
call fcn.004039e8
ret

Function at 0x468d44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403e28
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x468d5d
test al, 0x10
jne 0x468d61
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret