joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42feb0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 0xc]
mov eax, dword [0x587040]
xor eax, ebp
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], eax
mov ebx, 0xc
push ebx
call fcn.004ec94e
add esp, 4
mov edi, eax
movzx ecx, byte [ebp + 0x10]
mov dword [eax], fcn.00431050
mov byte [eax + 8], 0
mov dword [esp + 0x5c], ebx
xor eax, eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
cmp byte [esi + 0xb], 0
jns 0x42ff0c
mov esi, dword [esi]
lea ecx, [esp + 0x5c]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 4], eax
test eax, eax
je 0x43001c
mov esi, eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x20], xmm0
xor ebx, ebx
dec ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
xor eax, eax
mov byte [esp + 0x20], al
mov byte [esp + 0x50], al
mov ecx, dword [esp + 8]
mov eax, ecx
mov edx, dword [esp + 0xc]
or eax, edx
je 0x42ffeb
lea eax, [esp + 0x10]
push 0xd7
push str.....operadesktopwindowsos_operationsos_operations_impl.cc
push str.NamedMutexImpl
push eax
call fcn.004b8ac0
add esp, 0x10
cmp byte [esp + 0x50], 1
jne 0x42ff97
lea ecx, [esp + 0x20]
call fcn.004aacc0
lea eax, [esp + 0x20]
mov byte [eax + 0x30], 0
lea ecx, [esp + 0x20]
push 0
lea eax, [esp + 0x14]
push eax
call fcn.004aac50
lea eax, [esp + 0x20]
mov byte [eax + 0x30], 1
mov eax, dword [esp + 8]
not eax
mov edx, dword [esp + 0xc]
mov ecx, edx
xor ecx, 0x7fffffff
or ecx, eax
je 0x42fffb
mov ecx, dword [esp + 8]
add ebx, ecx
mov eax, edx
adc eax, 0x7fffffff
add ebx, 2
adc eax, 0
cmp ebx, 2
sbb eax, 0
jae 0x42ffeb
xor ebx, ebx
test edx, edx
setns bl
neg ebx
jmp 0x42fffb
push 0
push 0x3e8
push edx
push ecx
call fcn.00510ee0
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
sete byte [edi + 8]
cmp byte [esp + 0x50], 1
jne 0x43001c
lea ecx, [esp + 0x20]
call fcn.004aacc0
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x439bb0
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x587040]
xor eax, ebp
mov dword [esp + 0x88], eax
mov dword [esp + 4], ecx
lea edi, [ecx + 4]
push edi
push 0x56c928
push 1
push 0
push 0x557080
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x439d63
mov eax, dword [edi]
mov dword [esp + 8], eax
lea edi, [esp + 0x60]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
push edi
call ebx
movups xmm0, xmmword [edi]
movaps xmmword [esp + 0x70], xmm0
lea edi, [esp + 0x40]
push edi
call ebx
movups xmm0, xmmword [edi]
movaps xmmword [esp + 0x50], xmm0
lea esi, [esp + 0x20]
push esi
call ebx
movups xmm0, xmmword [esi]
movaps xmmword [esp + 0x30], xmm0
lea esi, [esp + 0x10]
push esi
call ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x28]
call dword [0x580f64]
sub esp, 0x44
movaps xmm0, xmmword [esp + 0xb4]
movups xmmword [esp + 0x34], xmm0
movaps xmm0, xmmword [esp + 0x94]
movups xmmword [esp + 0x24], xmm0
movaps xmm0, xmmword [esp + 0x74]
movups xmmword [esp + 0x14], xmm0
movups xmm0, xmmword [esi]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call ecx
test eax, eax
js 0x439cf3
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
push 0xc
call fcn.004ec94e
add esp, 4
mov edi, eax
mov dword [eax + 4], 0
mov dword [eax + 8], 1
push 0x56c0ba
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x439d67
mov dword [esp + 8], eax
test edi, edi
je 0x439d67
mov esi, dword [esp + 4]
add esi, 8
lea ecx, [edi + 8]
mov dword [esp + 0xc], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1c]
call dword [0x580f64]
push esi
push dword [esp + 0xc]
push ebx
call ecx
test eax, eax
setns al
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
lock dec dword [eax]
je 0x439cff
lea ebx, [esp + 0x10]
jmp 0x439d29
mov ebx, esi
mov dword [esp + 4], 0
jmp 0x439d2d
mov eax, dword [edi]
test eax, eax
lea ebx, [esp + 0x10]
je 0x439d10
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
test eax, eax
je 0x439d20
push eax
call fcn.004ec9bc
add esp, 4
push edi
call fcn.004ec97e
add esp, 4
lea edi, [esp + 0x40]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ebx
call esi
lea eax, [esp + 0x20]
push eax
call esi
push edi
call esi
lea eax, [esp + 0x60]
push eax
call esi
mov ebx, dword [esp + 4]
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.004ecef0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x439d4b
push 0x8007000e
call fcn.004ec930
int3
Function at 0x4445d0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov ebx, ecx
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0x5640b4
cmp byte [ecx + 0x1c], 0
je 0x4446e0
push 0x4c
push str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
call fcn.004b83c0
add esp, 8
test eax, eax
jle 0x44464b
lea edi, [ebp - 0xb4]
mov ecx, edi
push 0xffffffffffffffff
push 0x25
push str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
call fcn.00469590
lea eax, [ebp - 0xac]
push 0x12
push str.Actual_removal_of
push eax
call fcn.00494030
add esp, 0xc
lea ecx, [ebx + 0x10]
push ecx
push eax
call fcn.00464920
add esp, 8
mov ecx, edi
call fcn.00469a60
lea esi, [ebx + 0x10]
push esi
call fcn.0045e550
add esp, 4
test al, al
jne 0x444664
push esi
call fcn.00539a60
add esp, 4
cmp byte [ebx + 0x1e], 1
jne 0x444705
xor eax, eax
dec eax
lea edi, [ebp - 0xb4]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 0xc4], ebx
lea ecx, [ebx + 4]
push edi
call fcn.004b9d90
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ebx, [ebp - 0xc0]
jmp 0x4446c0
mov eax, dword [ebp - 0xb4]
push eax
call esi
test eax, eax
je 0x4446cd
mov ecx, edi
push ebx
call fcn.004b9d90
mov ecx, edi
push ebx
call fcn.004b97a0
mov ecx, ebx
call fcn.004b9720
cmp byte [ebp - 0xa9], 0
mov eax, edi
jns 0x4446a2
jmp 0x44469c
lea ecx, [ebp - 0xb4]
call fcn.004b9720
mov ebx, dword [ebp - 0xc4]
jmp 0x444705
cmp dword [ebx + 0x20], 0
je 0x444705
lea esi, [ebx + 0x20]
mov ecx, dword [0x58cdec]
test ecx, ecx
jne 0x4446ff
call fcn.0042a560
mov ecx, eax
mov dword [0x58cdec], eax
push esi
call fcn.0042b260
mov edi, dword [ebx + 0x20]
mov dword [ebx + 0x20], 0
test edi, edi
je 0x444723
mov ecx, edi
call fcn.0042be50
push edi
call fcn.004ec97e
add esp, 4
lea ecx, [ebx + 0x10]
call fcn.004b9720
add ebx, 4
mov ecx, ebx
call fcn.004b9720
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446550
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0x5640cc
cmp byte [ecx + 0x20], 1
jne 0x4465cc
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 0x2c], esi
lea ecx, [esi + 8]
push edi
call fcn.004b9d90
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ebx, [ebp - 0x28]
jmp 0x4465b7
mov eax, dword [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x4465c1
mov ecx, edi
push ebx
call fcn.004b9d90
mov ecx, edi
push ebx
call fcn.004b97a0
mov ecx, ebx
call fcn.004b9720
cmp byte [ebp - 0x11], 0
mov eax, edi
jns 0x446599
jmp 0x446596
lea ecx, [ebp - 0x1c]
call fcn.004b9720
mov esi, dword [ebp - 0x2c]
lea ecx, [esi + 0x14]
call fcn.004b9720
lea ecx, [esi + 8]
call fcn.004b9720
mov eax, dword [esi + 4]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x58ffec]
bt edx, ecx
jae 0x4465fe
push eax
call fcn.004bccd0
add esp, 4
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4484d0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [0x587040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, dword [eax]
test esi, esi
je 0x448619
push esi
call fcn.00507e54
add esp, 4
cmp eax, 0x7ffffff8
jae 0x44862f
mov ebx, eax
cmp eax, 4
jbe 0x448573
mov edi, ebx
or edi, 3
inc edi
js 0x448614
lea eax, [edi + edi]
push eax
call fcn.004ec94e
add esp, 4
mov dword [ebp - 0x1c], eax
or edi, 0x80000000
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
lea edi, [eax + ebx*2]
cmp eax, esi
seta cl
cmp edi, esi
setbe dl
or dl, cl
je 0x448620
test ebx, ebx
je 0x448559
add ebx, ebx
push ebx
push esi
push eax
call fcn.004f03c0
add esp, 0xc
mov word [edi], 0
movsx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 0x1c]
test ecx, ecx
mov dword [ebp - 0x20], edx
js 0x44857b
lea edx, [ebp - 0x1c]
mov edi, ecx
jmp 0x44857e
lea eax, [ebp - 0x1c]
mov byte [eax + 0xb], bl
jmp 0x448533
mov edi, dword [ebp - 0x18]
add edi, edi
mov esi, edi
cmp edi, 4
jb 0x4485ad
imul eax, dword [edx], 0x5bd1e995
mov ebx, eax
shr ebx, 0x18
xor ebx, eax
imul eax, ebx, 0x5bd1e995
imul esi, esi, 0x5bd1e995
xor esi, eax
add edx, 4
add edi, 0xfffffffc
cmp edi, 3
ja 0x448587
cmp edi, 2
je 0x4485fe
cmp edi, 3
je 0x4485f5
cmp edi, 1
je 0x448607
test cl, cl
jns 0x4485cb
push dword [ebp - 0x20]
call fcn.004ec97e
add esp, 4
mov eax, esi
shr eax, 0xd
xor eax, esi
imul eax, eax, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
movzx eax, byte [edx + 2]
shl eax, 0x10
xor esi, eax
movzx eax, byte [edx + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [edx]
xor eax, esi
imul esi, eax, 0x5bd1e995
jmp 0x4485bc
call fcn.0051bd90
push str....._third_partylibc_srcinclude_string:973:_assertion___s___nullptr_failed:_basic_string_const_char__detected_nullptr_n
jmp 0x448625
push str....._third_partylibc_srcinclude__stringchar_traits.h:222:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
push 0x565ab5
call fcn.0051c8d0
lea ecx, [ebp - 0x1c]
call fcn.0051bd70
int3
Function at 0x44fcd0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
lea edi, [ebp + 8]
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp + 0x18]
cmp byte [ecx + 5], 1
je 0x44fd21
xor ebx, ebx
cmp byte [edi + 0xc], 1
jne 0x44fcfe
mov ecx, edi
call fcn.004b9720
cmp byte [edi + 0x1c], 1
jne 0x44fd0b
mov ecx, esi
call fcn.004b9720
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x2c
mov ebx, ecx
mov esi, dword [ecx + 0x18]
test esi, esi
je 0x44fed4
mov ecx, dword [edi + 0x20]
mov edi, dword [edi + 0x24]
xor eax, eax
inc eax
lock xadd dword [esi], eax
test eax, eax
jle 0x44fed7
mov dword [ebp - 0x28], ecx
cmp eax, 0x7fffffff
je 0x44feda
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 4]
call dword [0x580f64]
push dword [ebp - 0x28]
push edi
push esi
call ecx
add esp, 0xc
lock dec dword [esi]
jne 0x44fd7b
push esi
mov byte [ebp - 0x28], al
call fcn.0046b320
mov al, byte [ebp - 0x28]
add esp, 4
test al, al
lea edi, [ebp + 8]
jne 0x44fd8c
xor ebx, ebx
lea esi, [ebp + 0x18]
jmp 0x44fcf1
cmp byte [edi + 0xc], 0
lea esi, [ebp + 0x18]
jne 0x44fdc3
add ebx, 0x14
lea ecx, [ebp - 0x20]
push ebx
call fcn.004b9460
cmp byte [edi + 0x1c], 0
je 0x44fec5
mov ecx, dword [edi + 0x20]
mov eax, dword [ebp - 0x20]
mov edx, esi
push eax
call fcn.0044fee0
add esp, 4
mov ebx, eax
jmp 0x44fcf1
cmp byte [edi + 0x28], 1
jne 0x44fde4
cmp byte [ebx + 5], 0
je 0x44febe
movzx eax, byte [ebx + 4]
mov edx, dword [edi + 0x20]
mov ecx, edi
push eax
call fcn.00450060
jmp 0x44fdb9
cmp byte [edi + 0x1c], 0
je 0x44fe56
cmp byte [ebx + 5], 0
je 0x44febe
movzx eax, byte [ebx + 4]
mov edx, dword [edi + 0x20]
mov ecx, edi
push eax
call fcn.00450060
add esp, 4
test al, al
je 0x44fcef
add ebx, 0x14
lea ecx, [ebp - 0x24]
push ebx
call fcn.004b9460
cmp byte [edi + 0x1c], 0
je 0x44fec5
mov ecx, dword [edi + 0x20]
mov eax, dword [ebp - 0x24]
mov edx, esi
push eax
call fcn.0044fee0
add esp, 4
mov bl, 1
test al, al
jne 0x44fcf1
mov eax, dword [edi + 0x20]
cmp byte [eax + 0xb], 0
jns 0x44fe4a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x44fcef
mov ebx, dword [edi + 0x20]
lea eax, [ebp - 0x1c]
mov ecx, ebx
push edi
push eax
call fcn.0046c440
mov ecx, ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.004b97a0
lea ecx, [ebp - 0x1c]
call fcn.004b9720
push ebx
call fcn.0045e880
add esp, 4
test al, al
jne 0x44fe96
push ebx
call fcn.00461190
add esp, 4
test al, al
je 0x44fcef
mov ecx, dword [0x58cdec]
test ecx, ecx
jne 0x44feac
call fcn.0042a560
mov ecx, eax
mov dword [0x58cdec], eax
push 0x12019f
push 1
push ebx
call fcn.0042a800
jmp 0x44fdbc
push str....._third_partylibc_srcincludeoptional:795:_assertion_this__has_value___failed:_optional_operator_called_on_a_disengaged_value_n
jmp 0x44feca
push str....._third_partylibc_srcincludeoptional:800:_assertion_this__has_value___failed:_optional_operator_called_on_a_disengaged_value_n
push 0x565ab5
call fcn.0051c8d0
int3
int3
int3
Function at 0x456aa0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x58dd64]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x456aed
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, 0x58dd60
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x58dd64
call fcn.004ec9c1
add esp, 4
cmp dword [0x58dd64], 0xffffffff
jne 0x456ad3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004f0940
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.004ec94e
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x58dd94]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x456b96
mov ecx, esi
push ebx
push 0x58dd70
push edi
call fcn.00456c90
mov dword [0x58dd60], esi
push 0x58dd64
call fcn.004eca3b
add esp, 4
jmp 0x456ad3
push 0x58dd94
call fcn.004ec9c1
add esp, 4
cmp dword [0x58dd94], 0xffffffff
jne 0x456b70
xorps xmm0, xmm0
movups xmmword [0x58dd80], xmm0
movups xmmword [0x58dd70], xmm0
mov dword [0x58dd90], 0
push 0x58dd70
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x58dd94
call fcn.004eca3b
add esp, 4
jmp 0x456b70

Function at 0x456bf0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x58dd94]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x456c21
movzx eax, word [0x58dd70]
cmp eax, 9
jne 0x456c6c
xor eax, eax
inc eax
pop ebp
ret
push 0x58dd94
call fcn.004ec9c1
add esp, 4
cmp dword [0x58dd94], 0xffffffff
jne 0x456c10
xorps xmm0, xmm0
movups xmmword [0x58dd80], xmm0
movups xmmword [0x58dd70], xmm0
mov dword [0x58dd90], 0
push 0x58dd70
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x58dd94
call fcn.004eca3b
add esp, 4
jmp 0x456c10
test eax, eax
je 0x456c1f
cmp eax, 6
jne 0x456c7c
mov eax, 2
jmp 0x456c1f
cmp eax, 0xc
jne 0x456c88
mov eax, 3
jmp 0x456c1f
mov eax, 4
jmp 0x456c1f
Function at 0x458290
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ecx + 4]
mov ebx, dword [ecx + 4]
lea eax, [ebx + 1]
cmp eax, 1
ja 0x4582fd
sub esp, 0x10
movsd xmm0, qword [0x5763c0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
cmp dword [edi], eax
je 0x4582fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x458378
mov eax, ebx
inc eax
cmp eax, 2
jb 0x4582f2
mov dword [edi], ebx
call fcn.004b8af0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [edi]
lea eax, [ebx + 1]
cmp eax, 2
jb 0x458399
xor eax, eax
inc eax
push eax
push ebx
push 0x1000000f
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x458392
lea ecx, [esi + 0x34]
lea ebx, [ebp + 0xc]
push ebx
call fcn.004b9420
lea edi, [esi + 8]
lea eax, [ebp - 0x20]
push 0x66
push str....._basewin_registry.cc
push str.StartWatching
push eax
call fcn.004b8ac0
add esp, 0x10
mov ecx, edi
lea eax, [ebp - 0x20]
push eax
push esi
push dword [esi + 4]
call fcn.004a4890
mov dword [ebp - 0x24], eax
mov ecx, ebx
call fcn.004b9490
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004b8af0
push dword [edi]
call fcn.004a4810
add esp, 4
mov dword [edi], 0
jmp 0x4582e3
mov ecx, edi
call fcn.0049eee0
mov dword [ebp - 0x24], 0
lea ebx, [ebp + 0xc]
jmp 0x45835a

Function at 0x458530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x18
pop ebp
ret 4
Function at 0x458560
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
test eax, eax
je 0x4585ec
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, dword [esi + 4]
lea edx, [ebp - 0x24]
mov dword [edx], ecx
mov ecx, ebx
or ecx, 0x10001
push edx
push ecx
push 8
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4585d4
lea eax, [ebp + 0xc]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
and ebx, 0x300
mov dword [ebp - 0x18], ebx
cmp byte [eax], 1
jne 0x4585f3
test ecx, ecx
je 0x4585c4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi + 4]
push dword [ebp + 8]
push dword [esi]
call fcn.00458650
add esp, 0xc
mov edi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, 6
jmp 0x4585d6
mov ebx, ecx
xor eax, eax
dec eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x24]
push eax
call fcn.004587c0
cmp byte [ebp - 0x20], 0
jne 0x458625
push 0
push dword [esi + 4]
push 0x56affc
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
jmp 0x458628
mov edi, dword [ebp - 0x24]
test ebx, ebx
je 0x4585d6
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4585d6
push 1
call fcn.00458b70
jmp 0x4585d6
Function at 0x458650
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x587040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor esi, esi
mov dword [ebp - 0x14], esi
mov ecx, ebx
or ecx, 0x10009
lea edi, [ebp - 0x24]
mov dword [edi], esi
mov edx, dword [ebp + 0xc]
push edi
push ecx
push 8
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4586fb
mov edx, edi
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
mov dword [ecx], edi
mov eax, ebx
and eax, 0x300
mov dword [ecx + 4], eax
xor eax, eax
dec eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
push edx
call fcn.004587c0
cmp byte [ebp - 0x20], 0
jne 0x4587a6
push 0
push ebx
push 0x56affc
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor esi, esi
test eax, eax
jne 0x458703
test edi, edi
je 0x4586dc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4587ae
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, 2
cmovne esi, eax
jmp 0x4586dc
mov esi, 0x200
push esi
call fcn.004ec9b3
add esp, 4
push esi
push 0
mov ebx, eax
push eax
call fcn.004f0940
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x24], 0x100
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp], edi
mov dword [esp + 4], 0
call esi
test eax, eax
jne 0x45877a
mov eax, dword [ebp - 0x24]
cmp eax, 0x100
jae 0x4587ba
cmp word [ebx + eax*2], 0
jne 0x4587bd
mov edi, dword [ebp - 0x1c]
push dword [ebp + 0x10]
push ebx
push edi
call fcn.00458650
add esp, 0xc
test eax, eax
je 0x458725
jmp 0x45877d
mov edi, dword [ebp - 0x1c]
push 0
push dword [ebp + 0x10]
push 0x56affc
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
test ebx, ebx
je 0x4586d1
push ebx
call fcn.004ec9bc
add esp, 4
jmp 0x4586d1
mov esi, dword [ebp - 0x24]
jmp 0x4586d1
push 1
call fcn.00458b70
jmp 0x4586e7
int3
int3
Function at 0x4587c0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
lea ecx, [ebp - 0x10]
mov dword [ecx], eax
push eax
push eax
push ecx
push eax
push str.SymbolicLinkValue
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x458811
mov byte [esi], 0
xor eax, eax
mov byte [esi + 4], al
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret 4
test eax, eax
jne 0x458858
cmp dword [ebp - 0x10], 6
jne 0x4587f4
push dword [edi]
call sub.ntdll.dll_NtDeleteKey
test eax, eax
je 0x45885e
mov edi, eax
mov eax, dword [0x58dda4]
mov ecx, dword [0x58a36c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x45886d
mov ecx, dword [0x58dda0]
test ecx, ecx
je 0x458866
call dword [0x580f64]
push edi
call ecx
mov dword [esi], eax
mov al, 1
jmp 0x4587f9
mov dword [esi], 0
jmp 0x45885a
mov eax, 5
jmp 0x458858
push 0x58dda4
call fcn.004ec9c1
add esp, 4
cmp dword [0x58dda4], 0xffffffff
jne 0x458845
push 0x576426
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlNtStatusToDosError
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x58dda0], eax
push 0x58dda4
call fcn.004eca3b
add esp, 4
jmp 0x458845

Function at 0x4588d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x587040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x458943
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x45892d
cmp dword [ebp - 0x18], 4
jne 0x45892d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ecef0
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x45892d