joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417cad
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x330
push ebx
push ebp
push esi
push edi
mov esi, 0x110
push esi
lea eax, [esp + 0x14]
push eax
push 0x821f68
call fcn.0040322f
lea eax, [esp + 0x1c]
push eax
push dword [0x81ff48]
lea eax, [esp + 0x134]
push esi
push eax
call fcn.004164d6
mov edi, dword [esp + 0x360]
add esp, 0x1c
lea eax, [esp + 0x120]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x417a08
push 0xfffffffffffffffc
mov ebx, 0x41a
push ebx
push edi
call ebp
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push ebx
push edi
mov dword [0x822a98], eax
call ebp
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
cmp byte [0x8218f8], 0
je 0x417d56
push esi
push 0x8218f8
call fcn.004179af
pop ecx
pop ecx
push 0x8218f8
push 0x3ea
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp byte [0x821a0c], 0
je 0x417dac
push esi
lea eax, [esp + 0x14]
push eax
push 0x821a0c
call fcn.0040322f
lea eax, [esp + 0x1c]
push eax
push dword [0x81fea8]
lea eax, [esp + 0x244]
push esi
push eax
call fcn.004164d6
add esp, 0x1c
lea eax, [esp + 0x230]
push eax
mov esi, 0x3ec
push esi
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x417db9
push 0
push 0x3ec
push edi
call ebp
push eax
call ebx
cmp dword [0x821b1c], 0
je 0x417dd2
push 1
push 0x3eb
push edi
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x417ddf
push 0
push 0x3eb
push edi
call ebp
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x330
ret
Function at 0x418070
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x910
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0x110
push edi
mov esi, 0x821f68
push esi
push ebx
mov dword [0x821f60], ebx
mov byte [0x821f68], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call fcn.00416d32
xor ecx, ecx
cmp eax, ecx
jne 0x4181cf
cmp dword [0x821b20], ecx
je 0x41814e
mov esi, 0x8218f8
push esi
call fcn.00417613
pop ecx
mov dword [0x822bc8], eax
test eax, eax
jne 0x41813d
cmp byte [0x821a0c], al
je 0x41813d
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push esi
call fcn.00402f07
mov ebx, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
pop ecx
push esi
call ebx
push esi
call fcn.00402ed5
mov dword [esp], 0x821a0c
push edi
push esi
call fcn.00402086
push 5
push 0
push 0x822078
push esi
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x418134
mov dword [0x822bc8], 0x6d67
lea eax, [ebp - 0x110]
push eax
call ebx
push dword [0x822bc8]
call fcn.00416401
pop ecx
jmp 0x4181cf
push ecx
push 0x417e92
push ecx
push 0x1389
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor ebx, ebx
cmp dword [0x822bc8], ebx
je 0x418172
call fcn.0041725a
jmp 0x4181cf
cmp byte [0x821a0c], bl
jne 0x4181cd
cmp dword [0x822bcc], ebx
jle 0x4181cd
push edi
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.0040322f
push dword [0x822bcc]
lea eax, [ebp - 0x110]
push eax
push dword [0x81feac]
lea eax, [ebp - 0x910]
push 0x800
push eax
call fcn.004164d6
add esp, 0x20
push 0x40
push dword [0x81ff40]
lea eax, [ebp - 0x910]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x418529
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x419660
call fcn.004182e0
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x41857c
mov eax, dword [0x40003c]
lea eax, [eax + 0x400000]
cmp dword [eax], 0x4550
jne 0x41857c
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x418594
cmp ecx, 0x20b
je 0x418581
mov dword [ebp - 0x1c], ebx
jmp 0x4185a8
cmp dword [eax + 0x84], 0xe
jbe 0x41857c
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x4185a2
cmp dword [eax + 0x74], 0xe
jbe 0x41857c
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x8257e4], edi
mov dword [0x8257e8], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x825544]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x825540]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x8257e0], eax
call fcn.00418736
cmp dword [0x41e3b0], ebx
jne 0x418605
push fcn.00418736
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00418724
push 0x41923c
push 0x419238
call sub.msvcrt.dll__initterm
mov eax, dword [0x82553c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x825538]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x419234
push 0x41922c
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x418690
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x418670
cmp cl, 0x22
jne 0x418661
cmp byte [eax], 0x22
jne 0x418679
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x418684
cmp cl, 0x20
jbe 0x418675
test byte [ebp - 0x54], 1
je 0x41869b
movzx ecx, word [ebp - 0x50]
jmp 0x41869e
cmp byte [eax], 0x20
jbe 0x418679
inc eax
mov dword [ebp - 0x20], eax
jmp 0x418690
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00418070
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x4186bc
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x4186f8
mov eax, esi
jmp 0x41870c
call fcn.0041831b
ret
Function at 0x43efb4
Capabilities:
Access the windows event log

Disassembly:
push 0x738
mov eax, 0x4a063f
call fcn.0043fd5f
lea eax, [ebp - 0x3b8]
push eax
push 0x403750
mov esi, ecx
push 2
mov dword [ebp - 0x3b8], esi
call fcn.0043f094
push esi
call fcn.0043dad8
mov edi, eax
lea eax, [ebp - 0x3b8]
push eax
push 0x403790
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x3b8], esi
call fcn.0043e5ad
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], ebx
jae 0x43f012
lea eax, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x3bc]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 1
push dword [0x4f11c8]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test esi, esi
jns 0x43f083
xor eax, eax
mov word [ebp - 0x43c], ax
mov word [ebp - 0x53c], ax
mov word [ebp - 0x740], ax
mov dword [ebp - 0x744], edi
push 0x4a66d0
lea eax, [ebp - 0x3b4]
mov ecx, 0xe2
lea esi, [ebp - 0x744]
lea edi, [ebp - 0x3b4]
mov dword [ebp - 0x540], 1
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll__CxxThrowException
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0043d71f
call fcn.0043fde2
ret

Function at 0x43f894
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403b5c]
jne fcn.0043fe83
ret

Function at 0x43fe83
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4f1378], eax
mov dword [0x4f1374], ecx
mov dword [0x4f1370], edx
mov dword [0x4f136c], ebx
mov dword [0x4f1368], esi
mov dword [0x4f1364], edi
mov word [0x4f1390], ss
mov word [0x4f1384], cs
mov word [0x4f1360], ds
mov word [0x4f135c], es
mov word [0x4f1358], fs
mov word [0x4f1354], gs
pushfd
pop dword [0x4f1388]
mov eax, dword [ebp]
mov dword [0x4f137c], eax
mov eax, dword [ebp + 4]
mov dword [0x4f1380], eax
lea eax, [ebp + 8]
mov dword [0x4f138c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4f12c8], 0x10001
mov eax, dword [0x4f1380]
mov dword [0x4f127c], eax
mov dword [0x4f1270], 0xc0000409
mov dword [0x4f1274], 1
mov eax, dword [0x403b5c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4b36cc]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x4f12c0], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x403b68
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x4f12c0], 0
jne 0x43ff6f
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x83a258
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0083a3a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x83a27e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83a26a
add dl, dl
jne 0x83a289
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83a2dc
xor eax, eax
add dl, dl
jne 0x83a296
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83a37d
add dl, dl
jne 0x83a2a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83a2b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83a2bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83a2c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x83a2d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x83a275
mov eax, 1
add dl, dl
jne 0x83a2ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83a2f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x83a2e1
sub eax, ebx
mov ebx, 1
jne 0x83a328
mov ecx, 1
add dl, dl
jne 0x83a30e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x83a319
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x83a305
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x83a275
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x83a33f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x83a34a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x83a336
cmp eax, 0x7d00
jae 0x83a36d
cmp eax, 0x500
jb 0x83a368
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x83a275
cmp eax, 0x7f
ja 0x83a370
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x83a275
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x83a39e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x83a275
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4015b4
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4015c6
mov eax, dword [0x4ea09f]
shl eax, 2
mov dword [0x4ea0a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, eax
call fcn.004d96cc
pop edx
call fcn.004d95f4
call fcn.004d9824
push 0
call fcn.004db494
pop ecx
push 0x4ea048
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x4ea0a7], eax
push 0
jmp fcn.004e5174
Function at 0x420358
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4203f6
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x4203ba
cmp byte [ebx + 0x10], 0
jne 0x4203ba
cmp byte [ebx + 0x3c], 0
jne 0x4203ba
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
je 0x4203db
lea edx, [ebp - 4]
mov eax, dword [0x4f31ac]
call fcn.00461de8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x410720]
call fcn.00448034
call fcn.0045dfe8
jmp 0x4203db
lea edx, [ebp - 8]
mov eax, dword [0x4f31ac]
call fcn.00461de8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x410720]
call fcn.00448034
call fcn.0045dfe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4203fd
lea eax, [ebp - 8]
mov edx, 2
call fcn.0045e824
ret

Function at 0x420d04
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x420d52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004202a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x420d6b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x420d74
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004202a4
dec esi
jne 0x420d96
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x42260c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4f3980
cmp dword [edi], 0
jne 0x422688
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4f397c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4ebc04
mov ecx, 2
call fcn.0045c4ac
mov edx, 0x4225e4
lea eax, [esi + 5]
call fcn.00422604
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00422604
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42265d
mov dword [0x4f397c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x425aa8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x425c23
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0045ebcc
mov eax, dword [ebp - 4]
call fcn.00425408
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x425afa
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0045f5c8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0042669c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x425bd9
xor eax, eax
push ebp
push 0x425bd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004256a8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00425c58
test al, al
je 0x425bb0
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0045e92c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x425bb0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0045f1d4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00425608
test al, al
je 0x425baa
mov eax, dword [ebp - 8]
call fcn.0045f1d4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0045f224
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00425aa8
dec ebx
cmp ebx, 0xffffffff
jne 0x425b59
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425bd9
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004256a8
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
call fcn.0045f1d4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00425694
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00425608
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425c2a
lea eax, [ebp - 0x3c]
call fcn.0045e7c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0045e824
ret

Function at 0x426578
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00425420
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0045f1d4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.00425608
test al, al
jne 0x4265e0
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4f364c]
mov dl, 1
mov eax, dword [0x42422c]
call fcn.00448238
call fcn.0045dfe8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4265ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0045f1d4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.00425608
test al, al
jne 0x42664d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4f3650]
mov dl, 1
mov eax, dword [0x42422c]
call fcn.00448238
call fcn.0045dfe8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00425450
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x426c4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x426d74
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004256a8
xor eax, eax
push ebp
push 0x426d4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00425c58
test al, al
je 0x426d33
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00426b2c
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0045e92c
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x426d33
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0045f1d4
push eax
push edi
push esi
call sub.ADVAPI32.DLL_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00425608
test al, al
je 0x426d2f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0045f1d4
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0045f224
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00426b2c
pop ecx
inc edi
dec ebx
jne 0x426cd7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426d56
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004256a8
ret
Function at 0x426d84
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x426fd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004256a8
xor eax, eax
push ebp
push 0x426fa8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00425c58
test al, al
je 0x426f8c
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0045e92c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x426f8c
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0045f1d4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00425608
test al, al
je 0x426f80
mov eax, dword [ebp - 4]
call fcn.0045f1d4
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0045f224
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042669c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x426f80
xor eax, eax
push ebp
push 0x426f79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004256a8
xor eax, eax
push ebp
push 0x426f5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045f1d4
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0045f224
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004256ac
mov eax, dword [ebp - 4]
call fcn.0045f1d4
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0045f224
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042669c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x426f38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00426c4c
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00426d84
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426f3f
mov eax, dword [ebp - 0x24]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x426e0f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426faf
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004256a8
ret