joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4e234
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4e24c
call fcn.00013d6c
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x1c]
call fcn.00026f34
mov eax, dword [ebp - 0x1c]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test esi, esi
jne 0x4e1e5
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0x10], 0x3ff
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4e25c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4e164
cmp dword [ebp - 0x14], 1
jne 0x4e164
cmp dword [ebp - 0x10], 0
jbe 0x4e164
cmp dword [ebp - 0x10], 0x14
ja 0x4e164
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.000272e8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.000273cc
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, 0x4e290
call fcn.000273cc
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.000140b8
sete byte [edi]
lea eax, [ebp - 0x18]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0x10], 0x3ff
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4e294
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4e1bd
cmp dword [ebp - 0x14], 1
jne 0x4e1bd
cmp dword [ebp - 0x10], 0
jbe 0x4e1bd
cmp dword [ebp - 0x10], 0x3ff
ja 0x4e1bd
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.00014548
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.00027218
lea eax, [ebp - 0x18]
mov edx, 0x400
call fcn.00027218
mov eax, ebx
mov edx, 0x4e2ec
call fcn.00013fb0
jmp 0x4e205
push dword [ebx]
push 0x4e2fc
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.00027478
push dword [ebp - 0x30]
mov eax, ebx
mov edx, 3
call fcn.00014068
cmp dword [ebp - 8], 0
je 0x4e214
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e23b
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00013d3c
ret
Function at 0x4e300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4e443
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
push ebp
push 0x4e41c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.00026f34
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0x14], 0x3ff
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4e454
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4e3fc
cmp dword [ebp - 0xc], 1
jne 0x4e3fc
cmp dword [ebp - 0x14], 0
jbe 0x4e3fc
cmp dword [ebp - 0x14], 0xc8
ja 0x4e3fc
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00013ee0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.000272e8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000273cc
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x4e494
call fcn.000273cc
mov edx, dword [ebp - 0x28]
pop eax
call fcn.000140b8
sete bl
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.00027218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e44a
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.00013d3c
ret

Function at 0x4e498
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4e54a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4e525
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4e558
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4e525
cmp dword [ebp - 0x10], 4
jne 0x4e525
mov ebx, dword [ebp - 4]
cmp dword [ebp - 0xc], 0
je 0x4e534
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e551
lea eax, [ebp - 0x14]
call fcn.00013d18
ret
Function at 0x4e57c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e61e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00026f34
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4e5f9
mov dword [ebp - 0xc], esi
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x4e630
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x4e608
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e625
lea eax, [ebp - 0x10]
call fcn.00013d18
ret

Function at 0x4e654
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4e706
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4e6e1
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4e714
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4e6e1
cmp dword [ebp - 8], 4
jne 0x4e6e1
mov ebx, dword [ebp - 4]
cmp dword [ebp - 0x10], 0
je 0x4e6f0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e70d
lea eax, [ebp - 0x14]
call fcn.00013d18
ret
Function at 0x4e740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e7e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00026f34
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4e7bd
mov dword [ebp - 4], esi
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x4e7f4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x4e7cc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7e9
lea eax, [ebp - 0x10]
call fcn.00013d18
ret

Function at 0x4e820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e922
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e8f7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x4e8ed
test bl, bl
je 0x4e8ad
lea eax, [ebp - 0xc]
mov edx, 0x4e93c
call fcn.00013db0
jmp 0x4e8ba
lea eax, [ebp - 0xc]
mov edx, 0x4e948
call fcn.00013db0
mov eax, dword [ebp - 0xc]
call fcn.00013fa8
mov ebx, eax
inc ebx
push ebx
mov eax, dword [ebp - 0xc]
call fcn.0001416c
push eax
push 1
push 0
push 0x4e94c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e901
mov ebx, dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e929
lea eax, [ebp - 0x14]
call fcn.00013d18
lea eax, [ebp - 0xc]
call fcn.00013d18
ret
Function at 0x4ed48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4ed50
push ecx
push ebx
xor eax, eax
push ebp
push 0x4ee6c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00026f34
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ee3d
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0x10], 0x3ff
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4ee7c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ee30
cmp dword [ebp - 8], 1
jne 0x4ee30
cmp dword [ebp - 0x10], 0
jbe 0x4ee30
cmp dword [ebp - 0x10], 0x3fc
ja 0x4ee30
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000272e8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.000273cc
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x4eea0
call fcn.000273cc
mov edx, dword [ebp - 0x24]
pop eax
call fcn.000140b8
sete bl
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 4], 0
je 0x4ee4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee73
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00013d3c
ret
Function at 0x4fa18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4fbc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.000143f0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00026f34
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4fb9a
xor ebx, ebx
lea eax, [ebp - 4]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0x14], 0x3ff
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4fbd8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4fb11
cmp dword [ebp - 8], 1
jne 0x4fb11
cmp dword [ebp - 0x14], 0
jbe 0x4fb11
cmp dword [ebp - 0x14], 0x3fc
ja 0x4fb11
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
call fcn.00013ee0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.000272e8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000273cc
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x4fbfc
call fcn.000273cc
mov edx, dword [ebp - 0x28]
pop eax
call fcn.000140b8
sete bl
lea eax, [ebp - 4]
mov edx, 0x400
call fcn.00027218
test bl, bl
je 0x4fb9a
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0x14], 0x3ff
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4fc00
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4fb8d
cmp dword [ebp - 8], 1
jne 0x4fb8d
cmp dword [ebp - 0x14], 0
jbe 0x4fb8d
cmp dword [ebp - 0x14], 0x3ff
ja 0x4fb8d
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.00014548
mov eax, dword [esi]
call fcn.00014630
cmp eax, 3
jge 0x4fb8d
mov eax, esi
call fcn.000143f0
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0xc], 0
je 0x4fba9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbd0
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.00013d3c
ret
Function at 0x4fc3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4fc44
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fe0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], bl
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00026f34
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4fddb
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0xc], 0x3ff
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4fe1c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4fdce
cmp dword [ebp - 0x14], 1
jne 0x4fdce
cmp dword [ebp - 0xc], 0
jbe 0x4fdce
cmp dword [ebp - 0xc], 0x3fc
ja 0x4fdce
test bl, bl
jne 0x4fd3d
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.00013ee0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.000272e8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000273cc
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x4fe40
call fcn.000273cc
mov edx, dword [ebp - 0x28]
pop eax
call fcn.000140b8
jne 0x4fdce
mov edx, 0x400
mov eax, dword [ebp - 8]
call fcn.00018100
mov dword [ebp - 0xc], 0x3ff
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4fe44
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4fdce
cmp dword [ebp - 0x14], 1
jne 0x4fdce
cmp dword [ebp - 0xc], 0
jbe 0x4fdce
cmp dword [ebp - 0xc], 0x3fc
ja 0x4fdce
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.00013ee0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.000272e8
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.000273cc
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x38]
mov eax, 0x4fe40
call fcn.000273cc
mov edx, dword [ebp - 0x38]
pop eax
call fcn.000140b8
sete byte [ebp - 1]
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0x10], 0
je 0x4fdea
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe11
lea eax, [ebp - 0x38]
mov edx, 9
call fcn.00013d3c
ret
Function at 0x4fe78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4fe80
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x50046
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], bl
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00026f34
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x50017
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 0x10], 0x3ff
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x50058
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5000a
cmp dword [ebp - 0xc], 1
jne 0x5000a
cmp dword [ebp - 0x10], 0
jbe 0x5000a
cmp dword [ebp - 0x10], 0x3fc
ja 0x5000a
test bl, bl
jne 0x4ff79
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.00013ee0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.000272e8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000273cc
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x5007c
call fcn.000273cc
mov edx, dword [ebp - 0x28]
pop eax
call fcn.000140b8
jne 0x5000a
mov edx, 0x400
mov eax, dword [ebp - 8]
call fcn.00018100
mov dword [ebp - 0x10], 0x3ff
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x50080
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5000a
cmp dword [ebp - 0xc], 1
jne 0x5000a
cmp dword [ebp - 0x10], 0
jbe 0x5000a
cmp dword [ebp - 0x10], 0x3fc
ja 0x5000a
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.00013ee0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.000272e8
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.000273cc
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x38]
mov eax, 0x5007c
call fcn.000273cc
mov edx, dword [ebp - 0x38]
pop eax
call fcn.000140b8
sete byte [ebp - 1]
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0x14], 0
je 0x50026
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5004d
lea eax, [ebp - 0x38]
mov edx, 9
call fcn.00013d3c
ret
Function at 0x500b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x500c0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x50286
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], bl
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00026f34
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x50257
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.000271f0
mov dword [ebp - 8], 0x3ff
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x50298
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5024a
cmp dword [ebp - 0xc], 1
jne 0x5024a
cmp dword [ebp - 8], 0
jbe 0x5024a
cmp dword [ebp - 8], 0x3fc
ja 0x5024a
test bl, bl
jne 0x501b9
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00013ee0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.000272e8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.000273cc
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x502bc
call fcn.000273cc
mov edx, dword [ebp - 0x28]
pop eax
call fcn.000140b8
jne 0x5024a
mov edx, 0x400
mov eax, dword [ebp - 0x10]
call fcn.00018100
mov dword [ebp - 8], 0x3ff
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x502c0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5024a
cmp dword [ebp - 0xc], 1
jne 0x5024a
cmp dword [ebp - 8], 0
jbe 0x5024a
cmp dword [ebp - 8], 0x3fc
ja 0x5024a
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x10]
call fcn.00013ee0
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.000272e8
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.000273cc
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x38]
mov eax, 0x502bc
call fcn.000273cc
mov edx, dword [ebp - 0x38]
pop eax
call fcn.000140b8
sete byte [ebp - 1]
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0x14], 0
je 0x50266
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5028d
lea eax, [ebp - 0x38]
mov edx, 9
call fcn.00013d3c
ret