joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb81c4f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 0x18]
test edx, edx
je 0xb81c9f
test ecx, ecx
jne 0xb81c89
mov eax, dword [edx + 0x528]
mov ecx, eax
and ecx, 0xf
test al, 0x20
je 0xb81c89
add ecx, 3
lea eax, [edx + 0x228]
push eax
push ecx
push 0x421
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov eax, dword [edi + 0x18]
test eax, eax
je 0xb81ccb
test byte [eax + 0x528], 0x10
jne 0xb81ccb
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
jb 0xb81ccb
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
call fcn.00c56726
mov ecx, edi
call fcn.00b8198a
mov ecx, dword [edi + 0x3c]
push 0x10
push 0
push ecx
mov esi, dword [ecx]
mov esi, dword [esi + 0x8c]
mov ecx, esi
call dword [0xc99200]
call esi
push 0x2c
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], 0x30
push 0
push eax
call fcn.00ab4bf6
mov eax, dword [edi + 0x18]
add esp, 0xc
test eax, eax
je 0xb81d30
mov ecx, dword [edi + 0xc]
add eax, 0x328
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x439
push ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov eax, dword [edi + 0x18]
mov dword [edi + 0x2c], 1
test eax, eax
je 0xb81ddb
push 0
lea eax, [ebp - 0x38]
push eax
push 0
push 0x2016
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
test eax, eax
je 0xb81d6e
imul eax, dword [ebp - 0x38], 0x3e8
mov dword [ebp - 0x38], eax
cmp eax, 0x2328
jb 0xb81d6e
add eax, 0xffffe890
jmp 0xb81d73
mov eax, 0xbb8
add eax, 0x3e8
mov ecx, edi
push eax
push 0xe
call fcn.00b81c0e
test al, al
je 0xb81ddb
mov byte [edi + 0x35], 0
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
push 0x3e8
push 4
mov esi, 0x403
mov dword [edi + 0x30], eax
push esi
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
push 0x1388
push 5
push esi
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
push 0
push 0
add esi, 0xe
push esi
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
lea eax, [ebp - 0x34]
push eax
push 1
push esi
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 8
Function at 0xb827bc
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xafc115
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0xc940a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x55c]
mov dword [esi], 0x9e6eac
cmp word [eax], 0
mov dword [esi + 4], 0x9e6e8c
mov dword [esi + 8], 0x9e6e9c
mov dword [esi + 0xc], 0x9e6e7c
je 0xb82827
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0xb82827
mov ecx, dword [ebp + 4]
mov edx, 0x91
push 0xa17200
call fcn.00b6203c
mov ecx, esi
call fcn.00b85976
lea ecx, [esi + 0x780]
call fcn.00a4a187
lea ecx, [esi + 0x77c]
call fcn.00a398c6
lea ecx, [esi + 0x778]
call fcn.00a398c6
lea ecx, [esi + 0x774]
call fcn.00a398c6
mov dword [esi + 0x14], 0xc0000001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0xb8532e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0xc940a0]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, 0x104
mov word [edi], ax
lea eax, [esp + 0x70]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
test eax, eax
jne 0xb8539f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xb85381
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xb85388
mov esi, 0x80004005
mov edx, 0x2be
mov ecx, dword [ebp + 4]
push esi
push 0xa17200
call fcn.00aa4c55
mov eax, esi
jmp 0xb85406
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateGuid]
mov esi, eax
test esi, esi
jns 0xb853b7
mov edx, 0x2c1
jmp 0xb8538d
push 0x27
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
test eax, eax
jg 0xb853d9
mov esi, 0x80004005
mov edx, 0x2c4
jmp 0xb8538d
push 0xa17234
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x78]
push eax
push 0xa172c8
push ebx
push edi
call fcn.00a60c0c
mov esi, eax
add esp, 0x18
test esi, esi
jns 0xb85404
mov edx, 0x2c6
jmp 0xb8538d
xor eax, eax
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00ab3c50
mov esp, ebp
pop ebp
ret 8
Function at 0xb8645d
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
xor eax, eax
mov esi, ecx
mov bl, al
mov dword [edi], eax
test esi, esi
je 0xb86526
push 0x3c
pop ebx
push ebx
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.00ab4bf6
mov dword [ebp - 0x244], ebx
lea eax, [ebp - 0x208]
push 0x202
xor ebx, ebx
push ebx
push eax
call fcn.00ab4bf6
mov ecx, esi
mov dword [ebp - 0x230], 0x101
lea eax, [ebp - 0x208]
add esp, 0x18
mov dword [ebp - 0x234], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb864d0
lea eax, [ebp - 0x244]
sub ecx, edx
push eax
push ebx
sar ecx, 1
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0xb864fb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb86526
lea ecx, [ebp - 0x208]
mov bl, 1
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xb86508
sub ecx, edx
lea eax, [ebp - 0x208]
push edi
sar ecx, 1
push ecx
push ecx
push eax
call fcn.00a54bd0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret

Function at 0xb871c4
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx + 0xc], edx
je 0xb87223
test edx, edx
mov dword [ecx + 0xc], edx
setne al
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x9f05b0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xb87220
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x9f4da4
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret 4
Function at 0xb8ab30
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov edx, dword [edi + 0x10]
cmp edx, 4
jb 0xb8ab59
mov al, 1
cmp dword [edi + 0x448], ecx
je 0xb8ab5b
mov al, cl
cmp byte [ebp + 0x10], cl
je 0xb8ac8c
test al, al
je 0xb8ac4a
mov ebx, dword [ebp + 0x14]
mov esi, ecx
test ebx, ebx
je 0xb8ac0e
push ecx
push dword [ebp + 0x18]
push 0x419
push ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0xb8ac05
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetCursorPos]
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
push 1
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push eax
push ebx
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_MapWindowPoints]
lea eax, [esp + 0x20]
push eax
push esi
push 0x445
push ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jne 0xb8abec
movzx esi, word [esp + 0x1c]
movzx eax, word [esp + 0x18]
push 2
shl esi, 0x10
pop ebx
or esi, eax
jmp 0xb8ac07
push ecx
push ebx
push 0xfffffffffffffffe
mov dword [esp + 0x18], 1
call fcn.00b89b6e
mov ebx, dword [esp + 0xc]
mov esi, eax
jmp 0xb8ac07
mov ebx, esi
mov edx, dword [edi + 0x10]
xor ecx, ecx
jmp 0xb8ac1f
movzx esi, word [4]
mov ebx, ecx
movzx eax, word [ecx]
shl esi, 0x10
or esi, eax
cmp edx, 4
jb 0xb8ac33
push 0xffffffffffffffff
push ecx
push esi
push 0x406
push edi
call fcn.00b8c4b1
mov esi, dword [ebp + 0xc]
xor eax, eax
push 0x16
push eax
push eax
push eax
push eax
push eax
push dword [esi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowPos]
jmp 0xb8ac4f
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push 0xb87960
call fcn.00b8d0b7
sub esp, 0xc
mov ecx, eax
call fcn.00a499f8
test al, al
je 0xb8ac9f
push 0xb87960
call fcn.00b8d0b7
mov ecx, dword [esp + 0x14]
xor eax, eax
add ecx, 0x60
cmp esi, ecx
setne al
xor esi, esi
push eax
push esi
push edi
push ebx
call fcn.00b88ccb
jmp 0xb8ac9f
test al, al
je 0xb8ac9f
push 0xffffffffffffffff
push ecx
push ecx
push 0x407
push edi
call fcn.00b8c4b1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0xb8b489
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
call fcn.00b8a774
cmp dword [ebp + 0xc], 0x5de
mov edi, eax
jne 0xb8b4ba
push dword [ebp + 0x14]
mov ecx, dword [esi + 0xfc]
call fcn.00b7fa42
jmp 0xb8b561
cmp dword [ebp + 0x14], 0
jne 0xb8b561
xor ebx, ebx
cmp dword [esi + 0x1ac], ebx
je 0xb8b4d9
mov dword [esi + 0x1ac], ebx
jmp 0xb8b561
mov eax, dword [esi + 0xfc]
push 5
mov byte [eax + 0x2c], bl
mov eax, dword [esi + 0xfc]
push dword [eax + 0x20]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
mov ecx, dword [esi + 0xfc]
push ebx
call fcn.00b7f934
push ebx
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00a48ab1
mov edi, eax
test edi, edi
je 0xb8b561
cmp dword [edi + 0x10], 4
jb 0xb8b524
xor ebx, ebx
cmp dword [esi + 0xdc], ebx
setne bl
sub ebx, 2
push 0
push dword [ebp + 0xc]
push 0x419
push dword [ebp + 0x10]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
cmp dword [esi + 0xdc], 0
mov ecx, esi
push eax
push dword [ebp + 0x10]
movzx eax, byte [esi + 0xb8]
push eax
setne al
movzx eax, al
push eax
push ebx
push edi
call fcn.00b8a7a3
mov byte [esi + 0xb8], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10
Function at 0xb8d240
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
movzx edx, word [ebp + 0xc]
movzx eax, word [ebp + 8]
shl edx, 0x10
or edx, eax
push edx
push 0xa
push 0x419
push ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
test eax, eax
setne al
pop ebp
ret 8

Function at 0xb8d998
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0xc940a0]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0xb8d9c9
push 0
push dword [esi + 0x10]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ShowWindow]
jmp 0xb8da4e
call fcn.00b8d8ff
xor edi, edi
test byte [0xc96fc1], 4
je 0xb8d9fc
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0xb8d9e4
mov eax, edi
jmp 0xb8d9ec
push ecx
push 3
call fcn.00a44eeb
push eax
mov edx, 0xa14888
mov ecx, 0xc933f0
call fcn.00a4c865
mov ecx, esi
call fcn.00b8da62
mov ecx, dword [ebp + 0xc]
mov bl, al
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff0
add ecx, 0x57
push ecx
push edi
push edi
push edi
push edi
push edi
push dword [esi + 0x10]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowPos]
test bl, bl
jne 0xb8da2e
push 1
mov ecx, esi
call fcn.00b8df53
test byte [0xc96fc1], 4
je 0xb8da4e
lea eax, [esp + 0x10]
mov edx, 0xa148c8
push eax
push 1
push ecx
mov ecx, 0xc933f0
call fcn.00a4d1e0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00ab3c50
mov esp, ebp
pop ebp
ret 8
Function at 0xb9f17b
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x38], 0x200
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], 0xa17bec
mov dword [ebp - 0x28], 0xa17c30
mov dword [ebp - 0x20], 5
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0xb9f1d8
mov ecx, dword [ebp + 4]
mov edx, 0xc05
push 0x9fa630
call fcn.00b5af13
leave
ret
xor eax, eax
leave
ret

Function at 0xb9ff55
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_SetRectEmpty]
push 0
push 0x9f1514
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
test eax, eax
je 0xb9ff9a
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowRect]
test eax, eax
je 0xb9ff9a
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret 4

Function at 0xba015b
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push ebx
push 0x9f1514
push ebx
push ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowExW]
test eax, eax
je 0xba01c1
push esi
push edi
mov dword [ebp - 0x18], 2
lea edi, [ebp - 0x14]
mov esi, 0xa17c9c
mov dword [ebp - 0x24], 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x24]
push ecx
movsd dword es:[edi], dword [esi]
push ebx
push 0x4a
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
xor al, 0xff
and al, 1
pop edi
mov bl, al
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret

Function at 0xba176f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push 0x10
push 0xa189fc
push 0x9f0528
push reloc.SHCORE.dll_Ordinal_1
mov dword [edi], 1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jne 0xba17c6
push dword [ebp - 4]
call fcn.00a7e478
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
cmp esi, 0x490
je 0xba17be
cmp esi, 2
je 0xba17be
test esi, esi
jle 0xba17e2
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xba17f5
mov ecx, dword [ebp + 4]
push esi
push 0xa1638c
push 0x7d
pop edx
call fcn.00aa4c55
mov eax, esi
jmp 0xba17c0
Function at 0xba4bc0
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [esi], 1
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetUserDefaultLangID]
movzx edx, ax
mov eax, edx
and eax, 0x3ff
cmp ax, 4
jne 0xba4c0b
and edx, 0xfc00
mov eax, 0x800
cmp dx, ax
jne 0xba4c0b
lea ecx, [ebp - 4]
call fcn.00ba4e0f
test eax, eax
js 0xba4c0b
push 2
pop eax
cmp dword [ebp - 4], eax
jne 0xba4c0b
mov dword [esi], eax
xor eax, eax
pop esi
leave
ret

Function at 0xba96dd
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
sub eax, 0x55c
je 0xba971b
sub eax, 1
jne 0xba9714
cmp dword [ebp + 0xc], eax
je 0xba9714
xor edi, edi
push edi
push edi
push dword [ebx + 0x30]
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_479]
push dword [0xc9585c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp dword [ebp + 0xc], 0
je 0xba96fb
mov ecx, dword [ebx + 0x1ec]
xor edi, edi
push edi
push 0x10002
push 0x128
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0xc99200]
call esi
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov eax, dword [ebx + 0x1ec]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xc99200]
call esi
push eax
push 1
push 0x459
push dword [0xc9585c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov eax, dword [ebx + 0x1ec]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xc99200]
call esi
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetForegroundWindow]
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push edi
test ax, ax
jns 0xba97b5
push 0x409
push dword [ebx + 0x50]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
push edi
mov esi, eax
push edi
jmp 0xba97be
mov eax, dword [ebx + 0x1ac]
mov esi, dword [eax + 0x10]
push dword [ebx + 0x30]
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_479]
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetFocus]
jmp 0xba9714
Function at 0xbb3f46
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x18], 0xa1b128
lea esi, [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0xa1b110
mov dword [ebp - 0xc], 4
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [esi]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xbb3fa5
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 4]
jne 0xbb3fa5
cmp dword [ebp - 8], 0
je 0xbb3fa5
add esi, 8
lea ecx, [ebp - 8]
cmp esi, ecx
jne 0xbb3f6e
mov al, 1
jmp 0xbb3fa7
xor al, al
pop esi
leave
ret 4

Function at 0xbb418a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
push esi
mov esi, edx
test ecx, ecx
jne 0xbb41b8
push 0x57
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0xbb4223
test esi, esi
je 0xbb41dc
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push esi
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xbb41d9
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0xbb41df
push eax
jmp 0xbb41ae
mov dword [ebp - 4], ecx
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x9f4114
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0xbb4208
cmp dword [ebp - 0xc], 4
je 0xbb420b
push 0xd
pop edi
mov dword [ebp - 8], ebx
test esi, esi
je 0xbb4218
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xbb5906
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x128]
push pe_nt_image_headers32
xor ebx, ebx
mov dword [ebp - 0x33c], ecx
push ebx
push eax
mov dword [ebp - 0x338], edi
mov esi, 0x80004005
call fcn.00ab4bf6
xor eax, eax
mov dword [ebp - 0x344], pe_nt_image_headers32
add esp, 0xc
mov word [edi], ax
cmp dword [0xc9780c], eax
jne 0xbb5a63
push 0x104
lea eax, [ebp - 0x330]
mov dword [0xc9780c], 1
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
je 0xbb5a56
push 0xa1b3dc
mov edx, 0x104
lea ecx, [ebp - 0x330]
call fcn.00bb4229
test eax, eax
js 0xbb5a56
push 0x400
push 8
pop edx
lea ecx, [ebp - 0x330]
call fcn.00bf4eb5
mov dword [ebp - 0x334], eax
test eax, eax
je 0xbb5a56
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
and dword [0xc9780c], eax
inc ebx
rep stosd dword es:[edi], eax
push ecx
push ecx
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x28]
push eax
call fcn.00bb5fde
mov esi, eax
test esi, esi
js 0xbb5a43
lea edx, [ebp - 0x340]
lea ecx, [ebp - 0x28]
call fcn.00bb5696
mov edi, dword [ebp - 0x334]
mov esi, eax
test esi, esi
js 0xbb5a49
push ecx
lea eax, [ebp - 0x128]
mov ecx, edi
push eax
push dword [ebp - 0x340]
call fcn.00bb61c5
mov esi, eax
test esi, esi
js 0xbb5a49
mov ecx, dword [ebp - 0x338]
lea eax, [ebp - 0x128]
push eax
push 0x20
pop edx
call fcn.00bb426a
mov esi, eax
xor ebx, ebx
test esi, esi
sets bl
jmp 0xbb5a49
mov edi, dword [ebp - 0x334]
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov edi, dword [ebp - 0x338]
cmp dword [0xc9780c], 0
jne 0xbb5a63
test ebx, ebx
je 0xbb5aab
lea eax, [ebp - 0x344]
mov esi, 0x80004005
push eax
lea eax, [ebp - 0x128]
push eax
push 0
push 0
push 0xa1b214
push dword [ebp - 0x33c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xbb5aab
lea eax, [ebp - 0x128]
mov ecx, edi
push eax
push 0x20
pop edx
call fcn.00bb426a
mov esi, eax
test esi, esi
js 0xbb5aab
mov esi, 0x40203
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 0x10

Function at 0xbb5fde
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 0x40
push 0
push eax
mov esi, ecx
mov edi, 0x80004005
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x48], 0x40
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x9fc164
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xbb6044
mov word [ebp - 0x22], ax
mov ecx, ebx
lea eax, [ebp - 0x44]
push eax
push 0x12
pop edx
call fcn.00bb426a
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 0xc