joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52d94c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x5a9534
call fcn.00540fdc
sub esp, 0x7c
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x52d968
xor al, al
jmp 0x52db0a
and byte [ebp - 0xd], 0
push edi
test byte [ebp + 0x10], 1
je 0x52daca
mov al, byte [ebp + 0xf]
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x30], al
call fcn.00406080
mov edi, str.SOFTWARE_ahead_
push edi
call fcn.00540f60
pop ecx
push eax
push edi
lea ecx, [ebp - 0x30]
call fcn.0042bea0
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004573c0
push str.Info
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 1
push eax
call fcn.004573c0
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, esi
jne 0x52d9d4
mov eax, 0x5af328
lea ecx, [ebp - 0x14]
push ebx
push ecx
push 0x20019
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
push 1
neg ebx
sbb bl, bl
lea ecx, [ebp - 0x50]
inc bl
call fcn.00406080
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x60]
call fcn.00406080
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x30]
call fcn.00406080
test bl, bl
pop ebx
je 0x52daca
mov al, byte [0x61810c]
push 9
mov byte [ebp - 0x88], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x87]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x27
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp + 0x14]
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x52dac1
cmp byte [ebp - 0x88], al
je 0x52dac1
mov al, byte [ebp + 0xf]
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], al
call fcn.00406080
lea eax, [ebp - 0x88]
push eax
call fcn.00540f60
pop ecx
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x40]
call fcn.0042bea0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], 2
call fcn.0052f7da
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x40]
call fcn.00406080
mov byte [ebp - 0xd], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [ebp + 0x10], 2
pop edi
je 0x52db07
push dword [ebp + 8]
push dword [ebp + 0xc]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0052db17
add esp, 0xc
test eax, eax
je 0x52daec
mov byte [ebp - 0xd], 1
push dword [ebp + 8]
push dword [ebp + 0xc]
push SysReAllocStringLen
call fcn.0052db17
add esp, 0xc
test eax, eax
je 0x52db07
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x52db17
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x5a9563
call fcn.00540fdc
sub esp, 0x8c
mov al, byte [ebp + 0x13]
push ebx
push esi
xor esi, esi
push edi
push esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov byte [ebp - 0x24], al
call fcn.00406080
mov edi, str.SOFTWARE_ahead_
push edi
call fcn.00540f60
pop ecx
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.0042bea0
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.004573c0
push str.Info
push eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 1
push eax
call fcn.004573c0
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, esi
jne 0x52db8f
mov eax, 0x5af328
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
push 1
neg ebx
pop edi
lea ecx, [ebp - 0x80]
sbb bl, bl
push edi
inc bl
call fcn.00406080
and byte [ebp - 4], 0
push edi
lea ecx, [ebp - 0x90]
call fcn.00406080
or dword [ebp - 4], 0xffffffff
push edi
lea ecx, [ebp - 0x24]
call fcn.00406080
test bl, bl
je 0x52dcbb
mov dword [ebp + 0xc], edi
mov al, byte [0x61810c]
push 9
mov byte [ebp - 0x70], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x6f]
rep stosd dword es:[edi], eax
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x27
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x48]
push eax
call fcn.0052dcd1
pop ecx
pop ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], 2
cmp eax, esi
jne 0x52dc1c
mov eax, 0x5af328
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x52dccd
cmp byte [ebp - 0x70], al
je 0x52dccd
cmp dword [ebp + 0x10], esi
mov bl, 1
je 0x52dc96
mov al, byte [ebp + 0x13]
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
call fcn.00406080
lea eax, [ebp - 0x70]
push eax
call fcn.00540f60
pop ecx
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x34]
call fcn.0042bea0
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 3
call fcn.0052f7da
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00406080
inc dword [ebp - 0x14]
inc dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x48]
call fcn.00406080
test bl, bl
jne 0x52dbdf
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
xor bl, bl
jmp 0x52dc9c
Function at 0x52dd81
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x5a9580
call fcn.00540fdc
sub esp, 0x70
lea eax, [ebp - 0x14]
push ebx
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWARE_aheadPlug_ins
mov byte [ebp - 0xd], bl
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x52de96
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x1c], ebx
push eax
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x40
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x52de8d
push esi
push edi
mov esi, str.Plug_ins_
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], al
call fcn.00406080
push esi
call fcn.00540f60
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0042bea0
lea eax, [ebp - 0x7c]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004573c0
add esp, 0xc
mov eax, dword [eax + 4]
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x52de2d
mov eax, 0x5af328
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0052db17
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov edi, eax
mov byte [ebp - 4], bl
push 1
call fcn.00406080
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406080
cmp edi, ebx
je 0x52de61
mov byte [ebp - 0xd], 1
inc dword [ebp - 0x1c]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x18], 0x40
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x52dde6
pop edi
pop esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x52e28b
Capabilities:
Set registry value

Disassembly:
mov eax, 0x5a9600
call fcn.00540fdc
sub esp, 0x38
mov al, byte [ebp + 0xf]
and byte [ebp - 0xd], 0
push ebx
push esi
push edi
xor edi, edi
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x24], al
call fcn.00406080
mov esi, str.SOFTWARE_ahead_
push esi
call fcn.00540f60
pop ecx
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.0042bea0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [eax + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004573c0
push str.Info
push eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 1
push eax
call fcn.004573c0
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, edi
jne 0x52e301
mov eax, 0x5af328
lea ecx, [ebp - 0x14]
push edi
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push eax
mov al, byte [ebp + 0xc]
neg al
sbb eax, eax
add eax, reloc.OLEAUT32.dll_SysReAllocString
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
push 1
neg ebx
pop esi
lea ecx, [ebp - 0x34]
sbb bl, bl
push esi
inc bl
call fcn.00406080
and byte [ebp - 4], 0
push esi
lea ecx, [ebp - 0x44]
call fcn.00406080
or dword [ebp - 4], 0xffffffff
push esi
lea ecx, [ebp - 0x24]
call fcn.00406080
test bl, bl
je 0x52e3a4
push dword [ebp + 0x10]
call fcn.00540f60
pop ecx
inc eax
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
push esi
push edi
push str.User
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x52e39b
push dword [ebp + 0x14]
call fcn.00540f60
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push esi
push edi
push str.Company
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x52e39b
mov byte [ebp - 0xd], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x52e87e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x52e8bc
push dword [ebp + 8]
push ebx
call fcn.0052e929
pop ecx
test al, al
pop ecx
je 0x52e8e0
lea eax, [ebp - 0x108]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x52e8e0
cmp dword [ebp + 0xc], ebx
jne 0x52e8c0
mov al, 1
jmp 0x52e924
lea eax, [ebp - 0x108]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x52e8e0
push edi
call fcn.0053e13b
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x52e8e4
xor al, al
jmp 0x52e924
push esi
push edi
lea eax, [ebp - 0x108]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x52e91b
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x5fcd80
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x52e91b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
cmp dword [eax + 0x10], ecx
sbb bl, bl
inc bl
push esi
call fcn.0053d6fa
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x52ec09
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push ebx
push eax
xor ebx, ebx
push 3
push ebx
push str.CLSID436F4AD7_C95B_4d2f_B0F8_8DC643F7A200
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x52ec34
xor al, al
jmp 0x52ecdb
mov al, byte [0x61810c]
push esi
push edi
mov byte [ebp - 0x18], al
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 9
lea eax, [ebp - 8]
pop edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x52ec89
cmp byte [ebp - 0x18], bl
jne 0x52ecb3
inc dword [ebp - 0xc]
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 8], edi
push dword [ebp - 0xc]
push dword [ebp - 4]
jmp 0x52ec64
cmp byte [ebp - 0x18], bl
jne 0x52ecb3
xor esi, esi
call fcn.0054071f
movsx eax, al
imul eax, eax, 0x39
cdq
mov ecx, 0x7fff
idiv ecx
add al, 0x41
mov byte [ebp + esi - 0x18], al
inc esi
cmp esi, 8
jb 0x52ec90
mov byte [ebp + esi - 0x18], bl
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push 3
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
test eax, eax
setne bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x52ecde
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push 1
push esi
push str.CLSID436F4AD7_C95B_4d2f_B0F8_8DC643F7A200
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x52ed0e
xor al, al
jmp 0x52edc2
mov al, byte [0x61810c]
push ebx
push edi
mov byte [ebp - 0x18], al
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 9
lea eax, [ebp - 8]
pop edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x52ed67
cmp byte [ebp - 0x18], al
jne 0x52ed67
push dword [ebp + 0xc]
inc dword [ebp - 0xc]
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
jmp 0x52ed40
xor bl, bl
cmp byte [ebp - 0x18], bl
je 0x52ed9f
mov eax, dword [ebp + 0xc]
push dword [eax]
call fcn.00570bbc
mov edi, dword [ebp + 8]
cmp eax, esi
pop ecx
mov dword [edi], eax
je 0x52eda2
push dword [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 0x18]
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jmp 0x52eda2
mov edi, dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x52edbe
push dword [edi]
call fcn.00570be5
mov eax, dword [ebp + 0xc]
mov dword [edi], esi
pop ecx
mov dword [eax], esi
mov al, bl
pop edi
pop ebx
pop esi
leave
ret
Function at 0x52edc5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x52ee6a
lea eax, [ebp - 4]
mov dword [ebp - 8], esi
push eax
push 0x20019
push esi
push str.SOFTWARE_aheadPlug_ins
push ebx
call edi
test eax, eax
jne 0x52ee4f
push dword [ebp + 8]
lea eax, [ebp - 0x38]
push str.EnableDemo__i
push eax
call fcn.0053ed4e
add esp, 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
jne 0x52ee49
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], esi
jmp 0x52eeb6
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
cmp eax, 0x47
je 0x52ee66
cmp eax, 0x3a
je 0x52ee66
cmp eax, 0x48
je 0x52ee66
cmp eax, 0x49
jne 0x52ee6a
mov al, 1
jmp 0x52eeb9
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
push 0x20019
push esi
push str.SOFTWARE_aheadPlug_ins
push ebx
call edi
test eax, eax
jne 0x52eeb1
lea eax, [ebp + 8]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push str.EnableDemo
mov dword [ebp + 8], 4
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x10], esi
setne al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x52eed3
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x5a9693
call fcn.00540fdc
sub esp, 0xd0
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x52f028
cmp dword [ebp + 0x10], ebx
je 0x52f028
mov al, byte [ebp + 0xb]
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x28], al
call fcn.00406080
mov esi, str.SOFTWARE_aheadSharedRestrictions
push esi
call fcn.00540f60
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0042bea0
lea eax, [ebp - 0x28]
push 0x5fcd80
push eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], ebx
call fcn.004573c0
push dword [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004573c0
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebx
jne 0x52ef53
mov eax, 0x5af328
lea ecx, [ebp - 0x10]
push ecx
push 1
pop esi
push esi
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb al, al
push esi
inc al
lea ecx, [ebp - 0x58]
mov byte [ebp + 0xb], al
call fcn.00406080
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call fcn.00406080
or dword [ebp - 4], 0xffffffff
push esi
lea ecx, [ebp - 0x28]
call fcn.00406080
cmp byte [ebp + 0xb], bl
je 0x52f023
push esi
push 2
lea ecx, [ebp - 0xdc]
call fcn.0052f172
push dword [ebp + 0xc]
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 2
call fcn.0052f04b
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0xdc]
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 4
call fcn.0052f257
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x52efe4
mov eax, 0x5af328
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x18]
push dword [ebp + 0x10]
push ecx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
push esi
neg ebx
sbb bl, bl
lea ecx, [ebp - 0x48]
inc bl
call fcn.00406080
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call fcn.0052f037
mov al, bl
pop esi
jmp 0x52f02a
xor al, al
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x532d49
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 4]
push edi
xor edi, edi
push eax
push 1
mov esi, ecx
push edi
push str.CLSID4EC0690F_EA6F_4573_845F_782AD19F35DBInprocServer32
push SysReAllocStringLen
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x532ddc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xa
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push str.ThreadingModel
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x532dd3
push 0xa
lea eax, [ebp - 0x1c]
push str.Free
push eax
call fcn.00555ca0
add esp, 0xc
test eax, eax
je 0x532dd0
push 0xa
lea eax, [ebp - 0x1c]
push 0x60a820
push eax
call fcn.00555ca0
add esp, 0xc
test eax, eax
jne 0x532dd3
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
push esi
test eax, eax
push 0x60a810
push 0x17
setge cl
push edi
push 0x5b1858
mov dword [esi + 4], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x53315d
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x53316a
mov al, 1
pop edi
ret
cmp edi, 2
jae 0x533173
xor al, al
pop edi
ret
cmp byte [esp + 0x10], 0
push esi
je 0x533184
mov esi, dword [esp + 0xc]
mov ax, word [esi]
jmp 0x53319f
push 0
call fcn.00540741
push eax
call fcn.00540712
pop ecx
pop ecx
call fcn.0054071f
mov esi, dword [esp + 0xc]
mov word [esi], ax
inc esi
movzx eax, ax
inc esi
dec edi
push eax
dec edi
call fcn.00540712
test edi, edi
pop ecx
je 0x5331bc
call fcn.0054071f
xor byte [esi], al
inc esi
dec edi
jne 0x5331b1
pop esi
mov al, 1
pop edi
ret

Function at 0x533b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0xc], ecx
push ebx
lea ecx, [ebp - 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ebx, ebx
push edi
xor al, al
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 2
mov ecx, dword [ebp - 4]
mov edi, dword [ecx]
cmp edi, ebx
je 0x533b76
push ebx
push ebx
push ebx
push ebx
push str.LicenseKey
push edi
call esi
cmp eax, ebx
jne 0x533b73
push ebx
push ebx
push ebx
push ebx
push str.ActivationCode
push edi
call esi
cmp eax, ebx
sete al
add dword [ebp - 4], 4
dec dword [ebp - 8]
jne 0x533b4c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x533c3c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp byte [ecx + 0xc], al
jne 0x533c6d
mov ecx, dword [ecx + 8]
cmp ecx, eax
je 0x533c6d
xor edx, edx
cmp byte [ebp + 8], al
push 4
setne dl
mov dword [ebp + 8], edx
lea edx, [ebp + 8]
push edx
push 4
push eax
push str.ActivationCodeRequested
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebp
ret 4
Function at 0x533d1f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x5a9b97
call fcn.00540fdc
sub esp, 0x18
mov al, byte [ebp + 0x13]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x24], al
call fcn.00406080
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push ebx
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
push dword [edi]
call esi
cmp eax, ebx
jne 0x533db2
push dword [ebp - 0x10]
call fcn.00570bbc
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push ebx
push eax
call fcn.005415c0
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 0x10]
push dword [edi]
call esi
cmp eax, ebx
jne 0x533da9
push dword [ebp + 0xc]
call fcn.00540f60
pop ecx
push eax
lea ecx, [ebp - 0x24]
push dword [ebp + 0xc]
call fcn.0042bea0
push dword [ebp + 0xc]
call fcn.00570be5
pop ecx
mov esi, dword [ebp + 8]
mov al, byte [ebp - 0x24]
push ebx
mov ecx, esi
mov byte [esi], al
call fcn.00406080
push dword [0x5af33c]
lea eax, [ebp - 0x24]
mov ecx, esi
push ebx
push eax
call fcn.00427500
push 1
pop eax
mov dword [ebp - 0x14], eax
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00406080
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x53404f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x5a9be4
call fcn.00540fdc
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov esi, ecx
je 0x534060
cmp dword [ebp + 0x10], ebx
jne 0x534060
xor al, al
jmp 0x5340e9
mov ecx, dword [esi + 8]
push edi
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi + 4]
xor al, al
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0x1c]
cmp al, bl
jne 0x5340e8
mov ecx, dword [edi]
cmp ecx, ebx
mov dword [ebp - 0x14], ecx
je 0x5340dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push ebx
push str.LicenseKey
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x5340da
lea eax, [ebp - 0x14]
push str.ActivationCode
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00533d1f
push dword [0x5af33c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.00427500
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406080
mov eax, dword [ebp + 8]
cmp dword [eax + 8], ebx
setne al
jmp 0x5340dc
xor al, al
inc dword [ebp - 0x10]
add edi, 4
cmp dword [ebp - 0x10], 2
jl 0x534075
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc