joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77caa421
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x270], ecx
lea ecx, [ebp - 0x26c]
push ecx
push ebx
push eax
mov dword [ebp - 0x278], edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp + 0x18]
add eax, eax
push eax
push ebx
push dword [ebp - 0x270]
call sub.ntdll.dll_memset
add esp, 0xc
cmp dword [ebp - 0x274], 0xffffffff
je 0x77caa4af
cmp byte [ebp + 0xc], bl
jne 0x77cecabd
push edi
push dword [ebp + 0x18]
xor esi, esi
push dword [ebp - 0x270]
inc esi
call fcn.77cac425
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, esi
neg eax
pop edi
sbb eax, eax
and eax, dword [ebp - 0x270]
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0x14
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xc
jne 0x77cecb41
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x238]
push eax
push 5
lea eax, [ebp - 0x10]
push eax
call fcn.77cac425
lea eax, [ebp - 0x10]
push eax
call fcn.77caa2c7
cmp eax, ebx
je 0x77cecb41
push 5
lea ecx, [ebp - 0x1c]
push ecx
push 1
and eax, 0x3ff
push eax
call fcn.77d21071
push dword [ebp - 0x278]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp esi, 1
jne 0x77cecb41
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x270]
call fcn.77cac425
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x77caa4a3
jmp 0x77cecabd
Function at 0x77caaf3e
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
movzx eax, word [esi]
cmp ax, 2
jb 0x77cd9ab6
mov ecx, dword [esi + 4]
xor ebx, ebx
cmp ecx, ebx
je 0x77cd9ab6
test al, 1
jne 0x77cd9ab6
movzx edx, ax
shr edx, 1
cmp word [ecx + edx*2 - 2], bx
jne 0x77cd9ab6
cmp dword [ebp + 0x14], ebx
jne 0x77cd9ab6
add eax, 0xfffffffe
test byte [ebp + 8], 2
push edi
mov word [esi], ax
jne 0x77cd9a81
test byte [0x77d2b2b8], 2
jne 0x77ce9f0d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 0x10]
and eax, 0x300
or eax, 0x10000
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x14], 0x40
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov edi, eax
mov eax, dword [0x77d2b2a0]
cmp eax, ebx
jne 0x77ce9f1c
cmp edi, ebx
jl 0x77cab00f
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [ebp + 0xc]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
push edi
mov dword [esi + 4], eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop edi
pop esi
pop ebx
leave
ret 0x10
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
and eax, 0x300
or eax, 0x2000000
push eax
push ebx
push esi
push dword [ebp + 8]
call fcn.77cd6aa4
mov edi, eax
cmp edi, ebx
jge 0x77caafea
jmp 0x77cab00f
test eax, eax
je 0x77caafaf
jmp 0x77cd9a81
push 0x57
pop eax
jmp 0x77cab022
push esi
lea eax, [ebp + 8]
push eax
call fcn.77d1b8e2
jmp 0x77cd9aac
push dword [ebp + 0xc]
call eax
jmp 0x77caaff7
Function at 0x77cabfc2
Capabilities:
Write file on windows

Disassembly:
mov dword [ebp - 0x54], esi
jmp 0x77cac058
mov eax, 0x427
jmp 0x77cac0d8
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xd
pop ecx
mov esi, 0x77cac11c
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 8]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
cmp dword [0x77d2a688], esi
stosd dword es:[edi], eax
jne 0x77c91dec
lea eax, [ebp - 0x58]
push eax
push 1
push esi
push 0x77cac0ec
push 0x80000002
call sym.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x77c91df4
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push dword [ebp - 0x58]
mov dword [ebp - 0x60], 4
call sym.ADVAPI32.dll_RegQueryValueExA
push dword [ebp - 0x58]
mov edi, eax
call sym.ADVAPI32.dll_RegCloseKey
cmp edi, esi
jne 0x77c91df4
cmp dword [ebp - 0x5c], 4
jne 0x77c91df4
push 0xa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x54]
call sub.ntdll.dll__itow
add esp, 0xc
push 0x3a98
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push esi
push 0x80
push 3
push esi
push 3
push 0xc0000000
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebx], eax
je 0x77c91df4
push esi
push esi
lea ecx, [ebp - 0x64]
push ecx
push eax
mov dword [ebp - 0x64], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
cmp eax, 1
jne 0x77ce7053
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x68]
push eax
push 4
lea eax, [ebp - 0x54]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 4
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x77c91df4
Function at 0x77caca58
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x77ce1fae
push edi
mov edi, 0x77cac9f4
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
test al, al
je 0x77ce1fb8
mov eax, dword [ebp - 0x2c]
cmp ax, si
push ebx
mov ebx, dword [ebp - 4]
jne 0x77ce1fc2
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
push 0x40
mov dword [ebp - 0x40], eax
pop eax
push esi
push esi
push eax
push 1
push esi
push 0x80
push esi
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 8]
push 0xc0100080
push dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 0x34], esi
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x18], 2
mov byte [ebp - 0x13], 1
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x30], ecx
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 4
mov eax, 0xc000000d
jmp 0x77cacb26
mov eax, 0xc000003a
jmp 0x77cacb25
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
jmp 0x77cacaa8
Function at 0x77caffb8
Capabilities:
Read file on windows

Disassembly:
add eax, 0xffffffb0
cmp eax, 1
ja 0x77cb001c
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp - 4]
push ebx
call fcn.77cb0068
test eax, eax
jne 0x77cb001e
push dword [esi]
push ebx
call fcn.77cabb4b
jmp 0x77cb001c
cmp eax, 0x50
je 0x77cabb0c
jmp 0x77cb001c
push 0xd
pop eax
jmp 0x77cb001e
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call edi
cmp eax, 1
jne 0x77ce7279
cmp dword [ebp - 4], 0x28
jbe 0x77cabb23
mov eax, dword [ebx + 4]
cmp eax, 0xb
jb 0x77cb001c
cmp eax, 0xe
ja 0x77cabae6
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp - 4]
push ebx
call fcn.77cb0068
test eax, eax
jne 0x77cb001e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x77cb001e
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp - 4]
push ebx
call fcn.77cb0068
test eax, eax
mov dword [ebp + 0xc], eax
je 0x77ce72be
push dword [ebp + 8]
call fcn.77d146ce
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi], 0
mov eax, dword [ebp + 0xc]
jmp 0x77cb001e
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, 1
jne 0x77ce72ed
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 4], eax
jb 0x77ce72f7
mov eax, dword [ebx + 4]
cmp eax, 0x51
jne 0x77cabb19
jmp 0x77cabb0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x77ce72fa
push 0x18
pop edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi], 0
mov eax, edi
jmp 0x77cb001e
Function at 0x77cb0544
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
push ebx
push esi
mov esi, dword [ebp + 0x30]
push edi
lea ecx, [ebp + 0x20]
push ecx
push esi
push dword [ebp + 0x2c]
mov edi, eax
push dword [ebp + 0x28]
or eax, 4
push dword [ebp + 0x24]
shr edi, 2
push eax
push dword [ebp + 0x1c]
xor ebx, ebx
push dword [ebp + 0x18]
and edi, 1
push dword [ebp + 0x14]
mov dword [ebp + 0x20], ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessInternalW]
test eax, eax
je 0x77cdbeb0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 4
or eax, ecx
or edi, eax
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x77cb0602
mov ecx, dword [esi]
test cl, 2
mov dword [ebp + 0x30], ebx
jne 0x77cdbec5
cmp dword [ebp + 0x20], 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
jne 0x77cb05fd
push dword [ebp + 8]
push edi
call fcn.77cb0726
mov edi, eax
test edi, edi
je 0x77cb05ea
mov ebx, dword [ebp + 0x30]
test ebx, ebx
jne 0x77cdbef1
cmp dword [ebp + 0x20], 0
jne 0x77cdbf05
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x2c
push dword [ebp + 0x20]
jmp 0x77cb05d3
xor edi, edi
inc edi
jmp 0x77cb05ea
cmp dword [ebp + 0x20], ebx
je 0x77cdbebe
push dword [ebp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
jmp 0x77cb05f6
push eax
push ebx
mov ebx, 0x1fffff
push ebx
mov dword [ebp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esi], eax
jne 0x77cb05c3
push dword [esi + 8]
push eax
push ebx
call fcn.77cf232d
mov dword [esi], eax
jmp 0x77cb05c3
mov eax, dword [esi]
test eax, eax
je 0x77cdbefe
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esi], ebx
jmp 0x77cb05ea
push dword [ebp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cb05f4
Function at 0x77cb1168
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push dword [ebp + 0x20]
lea eax, [ebp - 0x24]
push dword [ebp + 0x1c]
xor ebx, ebx
push dword [ebp + 0x18]
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
push eax
call fcn.77ca02a7
mov esi, dword [ebp + 0x10]
test word [esi + 0x14], 0x100
je 0x77cb123b
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.77ca02df
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x77cb123b
mov esi, dword [esi + 0x198]
mov eax, dword [esi + 0x374]
inc dword [ebp - 0x24]
cmp dword [esi + 0x10], 2
mov dword [ebp + 0x20], eax
je 0x77ce3fc4
cmp dword [ebp - 0x24], ebx
je 0x77cb123b
push edi
mov edi, 0x4c7
push dword [ebp + 0x10]
call fcn.77cb1515
test al, al
je 0x77cb1261
cmp byte [esi + 0x384], bl
jne 0x77cb1261
lea eax, [esi + 0x364]
push eax
lea eax, [esi + 0x380]
push eax
push 8
lea eax, [esi + 0x378]
push eax
push dword [esi + 0x21c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x77cb158d
lea eax, [esi + 0x38]
push eax
push dword [esi + 0x378]
mov byte [esi + 0x384], bl
lea eax, [ebp - 0x24]
push eax
call fcn.77cb12a6
cmp eax, edi
je 0x77cb123a
cmp dword [ebp - 0x24], ebx
jne 0x77cb11d9
pop edi
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x198]
cmp eax, ebx
je 0x77cb124f
push ebx
push eax
call fcn.77ca0bec
lea eax, [ebp - 0x24]
push eax
call fcn.77cd8e27
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0x1c
push 0xffffffffffffffff
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x77ce3fdb
cmp byte [esi + 0x384], bl
je 0x77cb11ed
push ebx
lea eax, [esi + 0x380]
push eax
lea eax, [esi + 0x364]
push eax
push dword [esi + 0x21c]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x77cb1210
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x77cd8e82
mov byte [esi + 0x384], 1
jmp 0x77cb1235
cmp eax, 0x3e4
je 0x77cb159e
lea eax, [esi + 0x38]
push eax
push ebx
jmp 0x77cb1228
cmp dword [esi + 0x21c], ebx
je 0x77cb11ce
push esi
call fcn.77cd7652
jmp 0x77cb11ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x77cb123a
Function at 0x77cb1e61
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x10
pop ebx
push ebx
push 0x40
mov dword [ebp - 4], ebx
call edi
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
add eax, eax
push eax
push 0x40
call edi
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x77cb1ec4
test eax, eax
je 0x77cb1ec4
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x77cb1ec4
lea eax, [ebp - 4]
push eax
push dword [edi]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x77cb1ec4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x77ce9279
push dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp + 8], eax
call ebx
push dword [edi]
call ebx
and dword [esi], 0
and dword [edi], 0
mov eax, dword [ebp + 8]
jmp 0x77cb1ebd

Function at 0x77cb2f11
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x77cb3068
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov esi, 0x224
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x77cb2ffa
cmp ebx, eax
je 0x77cb301f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20019
lea eax, [ebp - 4]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x24], ecx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x77cb2ffa
push 0x77cb3050
lea eax, [ebp - 0x14]
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jge 0x77cdcb82
push 0x77cb3034
lea eax, [ebp - 0x14]
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x77cb3029
cmp dword [ebx + 4], 4
jne 0x77cb3029
mov al, byte [ebx + 0xc]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
je 0x77cb301f
push esi
push 0
push ebx
call sub.ntdll.dll_memset
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add esp, 0xc
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp + 8]
mov byte [eax], 0
jmp 0x77cb2ff1
cmp dword [ebx + 4], 4
jne 0x77cb2fbf
cmp dword [ebx + 0xc], 0
je 0x77cb2fbf
mov dword [ebp - 8], 1
jmp 0x77cb2fbf
Function at 0x77cb5175
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
or edi, 0xffffffff
cmp byte [0x77d260a8], bl
mov dword [ebp - 0x21c], eax
je 0x77ce0e00
push 0x77d26480
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x77d2a6ec], ebx
jne 0x77ce0e0a
cmp dword [ebp + 8], 1
je 0x77cb51d7
cmp dword [ebp + 8], 2
jne 0x77ce0e13
cmp byte [0x77d260c0], bl
jne 0x77ce0e1d
push 0x77d26860
call dword [sym.imp.ntdll.dll_RtlIsGenericTableEmpty]
test al, al
jne 0x77ce0e31
cmp byte [ebp + 0x18], bl
jne 0x77ce0e69
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x20019
push 0x77cb6eb4
push dword [0x77d2a6ec]
push dword [ebp + 8]
call fcn.77cb6edb
mov esi, eax
cmp esi, ebx
jl 0x77cb528b
cmp dword [ebp - 0x214], ebx
je 0x77cb5277
cmp dword [ebp + 0xc], 4
jb 0x77cb5277
push 0x77cb52ac
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x228]
push eax
push 0x20c
lea eax, [ebp - 0x210]
push eax
push 1
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp esi, ebx
jge 0x77ce0e3b
push dword [ebp - 0x218]
call dword [sym.imp.ntdll.dll_NtClose]
cmp esi, ebx
jge 0x77ce0ea5
push 0x77d26480
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0x14
mov esi, 0xc0000001
jmp 0x77cb5296
cmp dword [ebp + 8], 3
jmp 0x77cb51d1
mov esi, 0xc0000030
jmp 0x77cb528b
call fcn.77cb5069
mov esi, eax
cmp esi, ebx
jge 0x77cb51e3
jmp 0x77cb528b
mov esi, 0xc0000225
jmp 0x77cb528b
cmp dword [ebp - 0x20c], 4
jne 0x77ce0e5f
cmp dword [ebp - 0x204], 4
jne 0x77ce0e5f
mov eax, dword [ebp - 0x208]
mov edi, dword [ebp + eax - 0x210]
jmp 0x77cb5277
mov esi, 0xc0000225
jmp 0x77cb5277
cmp dword [ebp + 8], 2
jne 0x77ce0e97
cmp dword [0x77d2a6e4], ebx
jne 0x77ce0e8f
xor edi, edi
mov eax, dword [ebp - 0x214]
cmp eax, ebx
je 0x77ce0ec3
cmp dword [ebp + 0xc], 4
jb 0x77ce0ec3
mov dword [eax], edi
xor esi, esi
jmp 0x77ce0ec8
mov edi, dword [0x77d2a6d8]
jmp 0x77ce0ea5
cmp dword [0x77d2a6e0], ebx
je 0x77ce0e77
mov edi, dword [0x77d2a6d4]
cmp edi, ebx
je 0x77ce0e79
cmp edi, 0x1000
je 0x77ce0e79
cmp edi, 0x2000
je 0x77ce0e79
mov esi, 0xc0000001
jmp 0x77cb528b
mov esi, 0xc0000023
mov eax, dword [ebp - 0x21c]
cmp eax, ebx
je 0x77cb528b
mov dword [eax], 4
jmp 0x77cb528b
Function at 0x77cb52e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
or edi, 0xffffffff
cmp byte [0x77d260a8], bl
mov dword [ebp - 0x218], eax
je 0x77ce0d96
push 0x77d26480
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x77d2a6ec], ebx
jne 0x77ce0da0
cmp dword [ebp + 8], 1
je 0x77cb534a
cmp dword [ebp + 8], 2
jne 0x77ce0da9
cmp byte [0x77d260c0], bl
jne 0x77ce0db3
push 0x77d26860
call dword [sym.imp.ntdll.dll_RtlIsGenericTableEmpty]
test al, al
jne 0x77ce0dc7
cmp byte [ebp + 0x18], bl
jne 0x77ce0dd1
lea eax, [ebp - 0x214]
push eax
push ebx
push 0x20019
push 0x77cb6eb4
push dword [0x77d2a6ec]
push dword [ebp + 8]
call fcn.77cb6edb
mov esi, eax
cmp esi, ebx
jl 0x77cb5440
push 0x77cb546c
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x228]
push eax
push 0x20c
lea eax, [ebp - 0x210]
push eax
push 1
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
cmp esi, ebx
jl 0x77cb53fb
cmp dword [ebp - 0x20c], 4
jne 0x77cb545e
cmp dword [ebp - 0x204], 4
jne 0x77cb545e
mov eax, dword [ebp - 0x208]
mov edi, dword [ebp + eax - 0x210]
push dword [ebp - 0x214]
call dword [sym.imp.ntdll.dll_NtClose]
cmp esi, ebx
jl 0x77cb5440
push edi
push 0x77d26860
call fcn.77cb6e85
test eax, eax
je 0x77ce0dc7
mov eax, dword [ebp - 0x21c]
cmp eax, ebx
je 0x77cb5465
cmp dword [ebp + 0xc], 4
jb 0x77cb5465
mov dword [eax], edi
xor esi, esi
mov eax, dword [ebp - 0x218]
cmp eax, ebx
jne 0x77ce0df5
push 0x77d26480
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0x14
mov esi, 0xc0000225
jmp 0x77cb53fb
mov esi, 0xc0000023
jmp 0x77cb5432
mov esi, 0xc0000001
jmp 0x77cb544b
cmp dword [ebp + 8], 3
jmp 0x77cb5344
mov esi, 0xc0000030
jmp 0x77cb5440
call fcn.77cb5069
mov esi, eax
cmp esi, ebx
jge 0x77cb5356
jmp 0x77cb5440
mov esi, 0xc0000225
jmp 0x77cb5440
cmp dword [ebp + 8], 2
mov eax, dword [0x77d2a6e4]
je 0x77ce0de1
mov eax, dword [0x77d2a6e0]
cmp eax, ebx
mov edi, 0x40000
je 0x77cb540b
mov edi, dword [eax]
jmp 0x77cb540b
mov dword [eax], 4
jmp 0x77cb5440
Function at 0x77cb548b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x224], 0
and dword [ebp - 0x220], 0
push 0x77cb5514
push 1
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x77cb5504
push esi
lea eax, [ebp - 0x224]
push eax
push 0x218
lea eax, [ebp - 0x21c]
push eax
push 2
push 0x77cb552c
push dword [ebp - 0x220]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [ebp - 0x220]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
pop esi
jge 0x77ce0af0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.77cd6011
leave
ret
cmp dword [ebp - 0x218], 4
jne 0x77cb5504
cmp dword [ebp - 0x214], 4
jne 0x77cb5504
mov eax, dword [ebp - 0x210]
jmp 0x77cb5506

Function at 0x77cb579d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x77d2a618]
cmp eax, 2
je 0x77cb57f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.77cd6011
leave
ret
and dword [0x77d2a618], 0
and dword [ebp - 0x58], 0
and dword [ebp - 0x5c], 0
push 0x77cb5860
push 1
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x77cb5855
push esi
lea eax, [ebp - 0x5c]
push eax
push 0x50
lea eax, [ebp - 0x54]
push eax
push 2
push 0x77cb5878
push dword [ebp - 0x58]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [ebp - 0x58]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
pop esi
jl 0x77cb5855
cmp dword [ebp - 0x50], 4
jne 0x77cb5855
cmp dword [ebp - 0x4c], 4
jne 0x77cb5855
test byte [ebp - 0x48], 1
jne 0x77cdfdb1
mov eax, dword [0x77d2a618]
jmp 0x77cb57b9
mov dword [0x77d2a618], 1
jmp 0x77cb5855