joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x559a8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x599508]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._08lX__04lX__04lX__02lX_02lX__02lX_02lX_02lX_02lX_02lX_02lX
push ecx
call fcn.0051eea6
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.0052a757
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.0052a9e2
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x46fa70
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x5b30fc]
sub esp, 0x190
test eax, eax
je 0x46fa8b
mov eax, 1
add esp, 0x190
ret
push edi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
pop edi
je 0x46fac0
xor eax, eax
add esp, 0x190
ret
mov eax, 1
mov dword [0x5b30fc], eax
add esp, 0x190
ret
Function at 0x47fbe0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x55b663
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x599508]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x599508]
mov dword [esp + 0x14], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x599508]
mov dword [esi + 0x20], edx
mov eax, dword [0x599508]
mov dword [esi + 0x24], eax
mov ecx, dword [0x599508]
mov dword [esi + 0x28], ecx
mov edx, dword [0x599508]
mov dword [esi + 0x2c], edx
mov eax, dword [0x599508]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 6
call fcn.00524c37
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 7
call fcn.00524c37
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x14], 8
push ecx
mov ecx, edi
mov dword [esi], 0x569930
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x10], 2
mov dword [esi + 0x14], 1
call fcn.0052ab6b
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x481bd0
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.00468310
test eax, eax
je 0x481bec
mov dword [0x5b3124], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x5b3124], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebp
jne 0x481c2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x481c49
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x481c83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x481c9f
jne 0x481c83
test esi, esi
jne 0x481c6d
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x481c6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x481c83
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x481c83
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x481cbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x481ca3
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x481caf
mov dword [0x5b3124], ebx
jmp 0x481cc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x5b3124], eax
jmp 0x481cc6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x481cd3
push edi
call ebx
test esi, esi
je 0x481cda
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4825a0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x55b9db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push esi
push edi
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.00524c37
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x634], esi
test eax, eax
je 0x4825e4
push eax
lea ecx, [esp + 0x14]
call fcn.00524e13
mov eax, dword [esp + 0x660]
test eax, eax
je 0x4825f9
push eax
lea ecx, [esp + 0x14]
call fcn.00524e13
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x22d]
mov byte [esp + 0x22c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x400
test eax, eax
jle 0x482678
lea eax, [esp + 8]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0
push edx
call fcn.0048be10
add esp, 0x10
test eax, eax
jne 0x482671
lea ecx, [esp + 0x10]
mov dword [esp + 0x634], 0xffffffff
call fcn.00524c6a
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x624]
mov dword fs:[0], ecx
add esp, 0x630
ret
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0x64c]
mov ecx, dword [esp + 0x668]
mov edx, dword [esp + 0x664]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
mov edx, dword [esp + 0x65c]
push esi
mov esi, dword [esp + 0x654]
push 0
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebp, eax
test ebp, ebp
je 0x482731
mov ebx, dword [esp + 0x658]
test ebx, ebx
je 0x482731
test esi, esi
je 0x482731
call fcn.004b26c0
mov eax, dword [0x5b3570]
test eax, eax
je 0x482731
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x30]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.0048a9e0
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x5b3570]
lea ecx, [esp + 0x18]
mov dword [esp + 0x63c], 0xffffffff
call fcn.00524c6a
mov ecx, dword [esp + 0x634]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x630
ret
Function at 0x482ee0
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x482efd
cmp edi, 4
jbe 0x482efd
mov dword [0x5b3128], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x482f1c
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.0044ad20
cmp edi, 0xffffffff
je 0x482f30
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.0044ad20
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x482f48
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.0044ad20
mov eax, dword [esp + 0x20]
test eax, eax
je 0x482f5e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.0044aed0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x482f75
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.0044aed0
mov edx, dword [esp + 0x28]
test edx, edx
je 0x482f9b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [str.ImagePath]
push 2
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x482fb1
push eax
mov eax, dword [str.Group]
push eax
mov ecx, esi
call fcn.0044aed0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x482fc8
mov ecx, dword [str.DependOnGroup]
push eax
push ecx
mov ecx, esi
call fcn.0044b360
mov eax, dword [esp + 0x34]
test eax, eax
je 0x482fdf
mov edx, dword [str.DependOnService]
push eax
push edx
mov ecx, esi
call fcn.0044b360
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x483d40
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55bbf0
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x483d73
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp byte [esi], 0
jne 0x483d8a
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.00449ac0
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.00449be0
test eax, eax
je 0x483e36
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.0044c0e0
test eax, eax
jne 0x483deb
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00449b60
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x483e1e
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.0044a210
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.0052ab1b
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.0052a9e2
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x483efd
mov dword [eax], 0x10
jmp 0x483efd
mov edx, dword [0x599508]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x591ecc
push ecx
mov byte [esp + 0x24], 2
call fcn.0051eea6
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00449be0
test eax, eax
jne 0x483eaa
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.0052a9e2
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00449b60
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x483ee1
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.0044a210
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.0052ab1b
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.0052a9e2
mov eax, dword [esp + 0x20]
test eax, eax
je 0x483eef
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.0052a9e2
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00449b60
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x483f30
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55bc18
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x48403f
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x48403f
cmp byte [edi], bl
je 0x48403f
cmp byte [esi], bl
je 0x48403f
lea ecx, [esp + 0xc]
call fcn.00449ac0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x483fdd
cmp eax, 1
je 0x483fdd
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.00449be0
test eax, eax
jne 0x483fcb
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.00449c50
test eax, eax
je 0x48402e
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0044aed0
mov esi, eax
jmp 0x4840c2
mov edx, dword [0x599508]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x591ecc
push ecx
mov byte [esp + 0x2c], 1
call fcn.0051eea6
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00449be0
test eax, eax
jne 0x484053
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.0052a9e2
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00449b60
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x599508]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.00422e59
add esp, 8
cmp eax, ebx
je 0x48407b
inc eax
lea ecx, [esp + 0x2c]
push eax
call fcn.0052ab6b
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x484094
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.0052a9e2
jmp 0x484021
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0044aed0
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.0052a9e2
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.0052a9e2
lea ecx, [esp + 0xc]
call fcn.00449c30
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00449b60
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x484550
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x484591
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x484593
mov esi, edi
test esi, esi
je 0x484608
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x4845fd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x4845fd
cmp dword [esp + 0x1c], eax
jbe 0x4845ce
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x4845fd
cmp esi, edi
je 0x4845ef
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x484608
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x484620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x484685
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x484685
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x484685
cmp dword [esp + 0x18], eax
jbe 0x48466b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x484689
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x484760
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x4847bf
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x4847bf
cmp dword [esp + 0xc], 3
jne 0x4847bf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x4847bf
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x4847bf
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x4848a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x484914
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x484914
cmp dword [esp + 0x10], 3
jne 0x484914
mov edx, dword [esp + 0x18]
push edx
call fcn.00529cd7
mov edi, eax
add esp, 4
test edi, edi
je 0x484914
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x48490b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.00529d00
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x484920
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x55bc9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x599508]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x48498b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x48498d
mov esi, edi
test esi, esi
je 0x484a57
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x484a4c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x4849cf
cmp eax, 2
je 0x4849cf
cmp eax, 6
je 0x4849cf
cmp eax, 7
jne 0x484a4c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.00529cd7
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x484a32
lea ecx, [esp + 0x14]
call fcn.0052ab6b
cmp esi, dword [esp + 0x14]
je 0x484a27
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00529d00
add esp, 4
jmp 0x484a69
call fcn.00529d00
add esp, 4
lea ecx, [esp + 0x10]
push 0x5af6cc
call fcn.0052ab6b
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x484a57
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x484a69
push eax
lea ecx, [esp + 0x14]
call fcn.0052ab6b
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0052a757
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.0052a9e2
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x484bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x484be7
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x484bea
mov esi, dword [ebp + 8]
test esi, esi
je 0x484d9b
call fcn.00468390
test eax, eax
je 0x484cd4
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x484c0b
mov dword [ebp + 0x10], eax
jmp 0x484c3e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.004231a0
mov ecx, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp + 0x10], ebx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x484d8f
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x484c78
cmp eax, 2
je 0x484c78
cmp eax, 6
je 0x484c78
cmp eax, 7
jne 0x484d8f
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.00529cd7
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x484d7a
mov ecx, dword [ebp + 0x18]
call fcn.0043b230
cmp esi, dword [ebp + 8]
je 0x484d64
jmp 0x484d5d
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x484d8f
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x484d0e
cmp eax, 2
je 0x484d0e
cmp eax, 6
je 0x484d0e
cmp eax, 7
jne 0x484d8f
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.00529cd7
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x484d7a
mov ecx, dword [ebp + 0x18]
call fcn.0043b300
cmp esi, dword [ebp + 8]
je 0x484d64
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.00529d00
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00529d00
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x5af6cc
call fcn.0043b300
cmp esi, dword [ebp + 8]
je 0x484d9b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret