joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405390
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4053a0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x102
push 0
push 0x55d270
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call ebx
test eax, eax
jne 0x4053f9
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405408
lea ecx, [esi + esi + 2]
push ecx
push edi
push 1
push 0
push 0x55d214
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405408
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405410
sub eax, edx
lea edx, [esp + 0xc]
push edx
push 0x102
push 0
push 0x55d2f8
sar eax, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, eax
mov dword [esp + 0x20], 0
call ebx
mov esi, eax
test esi, esi
jne 0x40546a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405479
mov edx, dword [esp + 0x14]
lea ecx, [edi + edi + 2]
push ecx
push edx
push 1
push esi
push str.BIOSReleaseDate
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405479
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret 4

Function at 0x405490
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4054a0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x102
push 0
push 0x55d368
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call ebx
test eax, eax
jne 0x4054f9
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405508
lea ecx, [esi + esi + 2]
push ecx
push edi
push 1
push 0
push 0x55d33c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405508
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405510
sub eax, edx
lea edx, [esp + 0xc]
push edx
push 0x102
push 0
push 0x55d3e8
sar eax, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, eax
mov dword [esp + 0x20], 0
call ebx
mov esi, eax
test esi, esi
jne 0x40556a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405579
mov edx, dword [esp + 0x14]
lea ecx, [edi + edi + 2]
push ecx
push edx
push 1
push esi
push str.BIOSVersion
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405579
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret 4
Function at 0x405590
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405596
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push 0x55d448
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4055f2
mov eax, dword [esp + 8]
test eax, eax
je 0x405601
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.BIOSVendor
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405601
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405610
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405616
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftSQMClient
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x405672
mov eax, dword [esp + 8]
test eax, eax
je 0x405681
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.MachineId
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405681
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405690
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405696
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4056f2
mov eax, dword [esp + 8]
test eax, eax
je 0x405701
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.SusClientId
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405701
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x405710
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405716
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str..DEFAULTSoftwareMicrosoftIdentityCRLDeviceIdentitiesproductionS_1_5_20
push SysStringLen
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x405772
mov eax, dword [esp + 8]
test eax, eax
je 0x405781
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.ValidDeviceId
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405781
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405790
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405796
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4057f2
mov eax, dword [esp + 8]
test eax, eax
je 0x405801
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.MachineGuid
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405801
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405810
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405816
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str.SYSTEMCurrentControlSetControlDiagnosticsPerformanceBootCKCLSettings
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x405872
mov eax, dword [esp + 8]
test eax, eax
je 0x405881
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push 0x55d89c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405881
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x405890
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405896
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4058f2
mov eax, dword [esp + 8]
test eax, eax
je 0x405901
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.HwProfileGuid
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405901
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405910
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405916
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerRegistration
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x405972
mov eax, dword [esp + 8]
test eax, eax
je 0x405981
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.ProductId
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405981
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405990
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405996
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftUserManagerUsers1044478
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4059f2
mov eax, dword [esp + 8]
test eax, eax
je 0x405a01
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push 0x55dbf4
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405a01
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x405a10
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405a20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x102
push 0
push 0x55dcd8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call ebx
test eax, eax
jne 0x405a79
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405a88
lea ecx, [esi + esi + 2]
push ecx
push edi
push 1
push 0
push 0x55dbfc
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405a88
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405a90
sub eax, edx
lea edx, [esp + 0xc]
push edx
push 0x102
push 0
push 0x55dd78
sar eax, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, eax
mov dword [esp + 0x20], 0
call ebx
mov esi, eax
test esi, esi
jne 0x405aea
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405af9
mov edx, dword [esp + 0x14]
lea ecx, [edi + edi + 2]
push ecx
push edx
push 1
push esi
push str.OSProductPfn
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405af9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret 4

Function at 0x405b10
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405b20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionDefaultProductKey2
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call ebx
test eax, eax
jne 0x405b79
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405b88
lea ecx, [esi + esi + 2]
push ecx
push edi
push 1
push 0
push 0x55de60
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405b88
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405b90
sub eax, edx
lea edx, [esp + 0xc]
push edx
push 0x102
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
sar eax, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, eax
mov dword [esp + 0x20], 0
call ebx
mov esi, eax
test esi, esi
jne 0x405bea
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405bf9
mov edx, dword [esp + 0x14]
lea ecx, [edi + edi + 2]
push ecx
push edx
push 1
push esi
push str.OSProductContentId
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405bf9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret 4
Function at 0x405c10
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405c16
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x405c72
mov eax, dword [esp + 8]
test eax, eax
je 0x405c81
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.BackupProductKeyDefault
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405c81
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405c90
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405c96
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push 0x55e16c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x405cf2
mov eax, dword [esp + 8]
test eax, eax
je 0x405d01
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.LastConfig
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405d01
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405d10
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405d16
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push 0x55e238
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x405d72
mov eax, dword [esp + 8]
test eax, eax
je 0x405d81
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.BaseBoardManufacturer
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405d81
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret
Function at 0x405d90
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405d96
push esi
push edi
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x102
push 0
push 0x55e308
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x405df2
mov eax, dword [esp + 8]
test eax, eax
je 0x405e01
lea ecx, [edi + edi + 2]
push ecx
push ebx
push 1
push esi
push str.BaseBoardProduct
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x405e01
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x405e10
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405e20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x102
push 0
push 0x55e3e8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call ebx
test eax, eax
jne 0x405e79
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405e88
lea ecx, [esi + esi + 2]
push ecx
push edi
push 1
push 0
push 0x55e3bc
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405e88
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405e90
sub eax, edx
lea edx, [esp + 0xc]
push edx
push 0x102
push 0
push 0x55e478
sar eax, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, eax
mov dword [esp + 0x20], 0
call ebx
mov esi, eax
test esi, esi
jne 0x405eea
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405ef9
mov edx, dword [esp + 0x14]
lea ecx, [edi + edi + 2]
push ecx
push edx
push 1
push esi
push 0x55e450
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405ef9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret 4
Function at 0x405f10
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405f20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x102
push 0
push str.SYSTEMCurrentControlSetControlSystemInformation
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call ebx
test eax, eax
jne 0x405f79
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405f88
lea ecx, [esi + esi + 2]
push ecx
push edi
push 1
push 0
push 0x55e524
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405f88
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405f90
sub eax, edx
lea edx, [esp + 0xc]
push edx
push 0x102
push 0
push str.HARDWAREDESCRIPTIONSystemBIOS
sar eax, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, eax
mov dword [esp + 0x20], 0
call ebx
mov esi, eax
test esi, esi
jne 0x405fea
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405ff9
mov edx, dword [esp + 0x14]
lea ecx, [edi + edi + 2]
push ecx
push edx
push 1
push esi
push 0x55e5b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405ff9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret 4
Function at 0x408a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
push 0x101
xor esi, esi
push esi
push ecx
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408aaf
mov eax, dword [esp + 8]
test eax, eax
je 0x408abe
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 8]
push ecx
push esi
push 0x583648
push esi
push ebx
push eax
call edi
test eax, eax
jne 0x408aae
mov eax, dword [esp + 8]
test eax, eax
jbe 0x408aae
add eax, 0x108
push eax
mov dword [esp + 0xc], eax
call fcn.00408cb2
mov esi, eax
add esp, 4
test esi, esi
je 0x408aae
mov edx, dword [esp + 8]
push edx
push 0
push esi
call fcn.00508a80
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 8]
push eax
push esi
push 0x583648
push 0
push ebx
push ecx
call edi
test eax, eax
jne 0x408aa3
cmp dword [esp + 8], eax
ja 0x408aae
push esi
call fcn.00408cec
add esp, 4
xor esi, esi
pop edi
mov eax, dword [esp + 8]
test eax, eax
je 0x408abe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x408ad0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
push 0x101
xor esi, esi
push esi
push 0x55cf64
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408b8f
mov eax, dword [esp + 8]
test eax, eax
je 0x408b9e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 8]
push ecx
push esi
push 0x58364c
push esi
push 0x55cf40
push eax
call edi
test eax, eax
jne 0x408b8e
mov eax, dword [esp + 8]
test eax, eax
jbe 0x408b8e
add eax, 0x108
push eax
mov dword [esp + 0xc], eax
call fcn.00408cb2
mov esi, eax
add esp, 4
test esi, esi
je 0x408b8e
mov edx, dword [esp + 8]
push edx
push 0
push esi
call fcn.00508a80
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 8]
push eax
push esi
push 0x58364c
push 0
push 0x55cf40
push ecx
call edi
test eax, eax
jne 0x408b83
cmp dword [esp + 8], eax
ja 0x408b8e
push esi
call fcn.00408cec
add esp, 4
xor esi, esi
pop edi
mov eax, dword [esp + 8]
test eax, eax
je 0x408b9e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x408bb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push 0x101
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408c00
mov eax, dword [esp + 4]
test eax, eax
je 0x408c0f
lea edx, [esp]
push edx
push 0
push 0x583654
push 0
push str.NameServer
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x408c0f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 8
ret