joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1f8d17aa
Capabilities:
Read http header

Disassembly:
push 0x10
mov eax, 0x1f9636e0
call fcn.1f8a600e
mov ebx, ecx
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f8d17e3
test dword [eax + 0x1c], 0x400
je 0x1f8d17e3
push ebx
push 0x1f879438
push 0x132
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov ecx, dword [ebx + 0x22b0]
xor esi, esi
cmp ecx, esi
jne 0x1f8d1811
push esi
mov esi, 0x54f
push esi
push 0x1f879bb4
push 0x171b
push 0x1f879448
call fcn.1f8a7bdf
mov eax, esi
jmp 0x1f8d199e
mov eax, dword [ebp + 8]
cmp eax, esi
jne 0x1f8d182b
push ecx
mov esi, 0x54f
push esi
push 0x1f879ba8
push 0x171c
jmp 0x1f8d1800
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push esi
mov dword [eax], esi
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push 0x3f
push dword [ebx + 0x22c4]
mov dword [ebp - 0x1c], 0x54f
mov dword [ebp - 0x18], esi
call edi
cmp eax, esi
jne 0x1f8d196e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp eax, 0x7a
je 0x1f8d186f
cmp eax, 0x2f76
jne 0x1f8d196e
cmp eax, 0x2f76
jne 0x1f8d187d
xor eax, eax
jmp 0x1f8d199e
mov eax, dword [ebp - 0x18]
push 2
pop edx
xor ecx, ecx
shr eax, 1
mul edx
seto cl
push esi
neg ecx
or eax, ecx
lea ecx, [ebp - 0xd]
push ecx
push eax
call sym.WsmSvc.DLL_public:_static_void____stdcall_WSManMemory::Alloc_unsigned_int__class_TestSystem::CallSite_const___enum_TestSystem::Mode_
push eax
lea ecx, [ebp - 0x14]
call fcn.1f898885
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], esi
jne 0x1f8d18c0
push 0xe
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1f8fe52c
jmp 0x1f8d180a
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push esi
push 0x3f
push dword [ebx + 0x22c4]
call edi
cmp eax, esi
jne 0x1f8d1916
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x2f76
je 0x1f8d18af
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f8d1912
test dword [eax + 0x1c], 0x200
je 0x1f8d1912
push edi
push 0x1f879438
push 0x134
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov esi, edi
jmp 0x1f8d18af
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f8d1943
test dword [eax + 0x1c], 0x400
je 0x1f8d1943
push dword [ebp - 0x14]
push 0x1f879438
push 0x135
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f8970b0
push 0x1f879b98
push dword [ebp - 0x14]
call fcn.1f8a84aa
test eax, eax
je 0x1f8d195d
mov eax, dword [ebp + 8]
mov dword [eax], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1f8fe52c
jmp 0x1f8d1876
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f8d199b
test dword [eax + 0x1c], 0x200
je 0x1f8d199b
push dword [ebp - 0x1c]
push 0x1f879438
push 0x133
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov eax, dword [ebp - 0x1c]
call fcn.1f8a60fa
ret 4
Function at 0x1f8e6c04
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
mov eax, dword [0x1f97b00c]
mov ebx, 0x1f87e87c
cmp eax, 0x1f97b00c
je 0x1f8e6c36
test dword [eax + 0x1c], 0x1000
je 0x1f8e6c36
push edi
push ebx
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
xor ecx, ecx
cmp dword [ebp + 8], ecx
jne 0x1f8e6c5e
push ecx
push 0x54f
push 0x1f87e9c4
push 0x4e3
push 0x1f87e8b8
call fcn.1f8a7bdf
xor eax, eax
jmp 0x1f8e6d58
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ecx
jne 0x1f8e6c7d
push dword [ebp + 8]
push 0x54f
push 0x1f87e9b8
push 0x4e4
jmp 0x1f8e6d37
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
add edx, edx
cmp edx, dword [edi + 0xd300]
jbe 0x1f8e6ca4
push dword [ebp + 8]
push 0x54f
push 0x1f87e9ac
push 0x4ef
jmp 0x1f8e6d37
mov dword [esi + 4], 2
mov dword [esi + 0xc], ecx
mov dword [esi + 8], ecx
cmp eax, ecx
je 0x1f8e6d54
cmp word [eax], cx
je 0x1f8e6d54
mov edx, dword [edi + 0xd300]
push ecx
push ecx
mov dword [ebp + 0xc], edx
lea edx, [ebp + 0xc]
push edx
push dword [edi + 0xd2fc]
push 1
push ecx
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x1f8e6d45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xea
je 0x1f8e6d25
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f8e6d1a
test dword [eax + 0x1c], 0x800
je 0x1f8e6d1a
push edi
push esi
push ebx
push 0x34
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f89f5b3
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push esi
call dword [eax + 0x20]
jmp 0x1f8e6d41
push dword [ebp + 8]
push 0x54f
push 0x1f877d90
push 0x511
push 0x1f87e8b8
call fcn.1f8a7bdf
xor eax, eax
jmp 0x1f8e6d57
mov eax, dword [edi + 0xd2fc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1f90bd90
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x31c]
push esi
push 0
push 0x1f97b918
call sub.pcwum.dll_PerfStartProvider
test eax, eax
je 0x1f90bdc0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
call dword [edx + 0x20]
xor al, al
jmp 0x1f90be75
push pe_nt_image_headers32
push 0x1f97b940
push dword [esi]
call sub.pcwum.dll_PerfSetCounterSetInfo
test eax, eax
jne 0x1f90bdb0
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x1f97b928
push dword [esi]
call sub.pcwum.dll_PerfCreateInstance
mov ebx, eax
mov dword [edi + 0x320], ebx
test ebx, ebx
jne 0x1f90be0c
mov edi, dword [ebp + 8]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call dword [esi + 0x20]
xor al, al
jmp 0x1f90be74
lea eax, [edi + 0x324]
push eax
push 1
push ebx
push dword [esi]
call sub.pcwum.dll_PerfSetCounterRefValue
lea eax, [edi + 0x328]
push eax
push 2
push ebx
push dword [esi]
call sub.pcwum.dll_PerfSetCounterRefValue
lea eax, [edi + 0x32c]
push eax
push 3
push ebx
push dword [esi]
call sub.pcwum.dll_PerfSetCounterRefValue
lea eax, [edi + 0x330]
push eax
push 4
push ebx
push dword [esi]
call sub.pcwum.dll_PerfSetCounterRefValue
lea eax, [edi + 0x334]
push eax
push 5
push ebx
push dword [esi]
call sub.pcwum.dll_PerfSetCounterRefValue
add edi, 0x338
push edi
push 6
push ebx
push dword [esi]
call sub.pcwum.dll_PerfSetCounterRefValue
mov al, 1
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x1f9103fb
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xc
mov eax, 0x1f966c6b
call fcn.1f8a600e
mov eax, dword [0x1f97b00c]
mov edi, 0x1f97b00c
cmp eax, edi
je 0x1f910430
test dword [eax + 0x1c], 0x400
je 0x1f910430
push 0x1f8864dc
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895ce3
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1f91045b
push esi
push 0x54f
push 0x1f886564
push 0x1b8
push 0x1f886500
call fcn.1f8a7bdf
xor eax, eax
call fcn.1f8a60fa
ret 8
mov dword [ebp - 0x14], esi
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
push ecx
push 0x1f88e9dc
push eax
push esi
push 0x1f88eaac
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp ebx, esi
jge 0x1f9104e5
and eax, 0x1fff0000
cmp eax, 0x70000
mov eax, ebx
jne 0x1f91049a
and eax, 0xffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x20]
mov eax, dword [0x1f97b00c]
cmp eax, edi
je 0x1f9104c8
test dword [eax + 0x1c], 0x200
je 0x1f9104c8
push ebx
push 0x1f8864dc
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.1f8fe471
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1f8fe471
jmp 0x1f910451
push 0x1f8864ec
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
cmp ebx, esi
jne 0x1f910524
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [0x1f97b00c]
cmp eax, edi
je 0x1f9104c8
test dword [eax + 0x1c], 0x200
je 0x1f9104c8
push 0x1f8864dc
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895ce3
jmp 0x1f9104c8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push eax
call dword [ecx + 0xc]
push ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, dword [ebp - 0x18]
cmp ebx, esi
jge 0x1f91058e
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
mov eax, ebx
jne 0x1f91055e
and eax, 0xffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x20]
mov eax, dword [0x1f97b00c]
cmp eax, edi
je 0x1f9104c8
test dword [eax + 0x1c], 0x200
je 0x1f9104c8
push ebx
push 0x1f8864dc
push 0x32
jmp 0x1f9104bd
push esi
push esi
push 3
push 6
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
cmp ebx, esi
jge 0x1f910607
and eax, 0x1fff0000
cmp eax, 0x70000
mov eax, ebx
jne 0x1f9105ba
and eax, 0xffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x20]
mov eax, dword [0x1f97b00c]
cmp eax, edi
je 0x1f9105e8
test dword [eax + 0x1c], 0x200
je 0x1f9105e8
push ebx
push 0x1f8864dc
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.1f8fe471
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1f8fe471
mov eax, esi
jmp 0x1f910453
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], esi
xor esi, esi
mov dword [ecx], eax
inc esi
jmp 0x1f9105e8
Function at 0x1f91c26d
Capabilities:
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x811c9dc5
jmp 0x1f91c289
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
inc ecx
inc ecx
cmp ecx, dword [ebp + 0xc]
jne 0x1f91c27c
pop ebp
ret 8

Function at 0x1f920516
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1f97b198]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov edi, ecx
call fcn.1f8ab6d2
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1f920554
xor al, al
jmp 0x1f920604
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1f92055d
sub eax, edx
push 0x5c
sar eax, 1
pop ecx
cmp cx, word [ebp + eax*2 - 0x212]
lea eax, [ebp - 0x210]
jne 0x1f920585
push 0x1f888018
jmp 0x1f92058a
push 0x1f887ffc
push esi
push eax
call fcn.1f8980ef
test eax, eax
jge 0x1f9205be
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f92054d
test dword [eax + 0x1c], 0x200
je 0x1f92054d
push 0x1f887d8c
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895ce3
jmp 0x1f92054d
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push eax
mov ecx, edi
call fcn.1f8acca9
cmp dword [edi], 0
jne 0x1f920602
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f92054d
test dword [eax + 0x1c], 0x200
je 0x1f92054d
push 0x1f887d8c
push 0xb
jmp 0x1f9205b1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1f8a5ff9
leave
ret

Function at 0x1f927499
Capabilities:
Start http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
inc eax
push esi
mov word [ebp - 4], ax
xor eax, eax
push eax
push 2
mov word [ebp - 2], ax
push dword [ebp - 4]
mov esi, ecx
and dword [esi], 0
call dword [sym.imp.HTTPAPI.dll_HttpInitialize]
mov dword [esi], eax
test eax, eax
je 0x1f9274ee
mov ecx, dword [0x1f97b00c]
cmp ecx, 0x1f97b00c
je 0x1f9274ee
test dword [ecx + 0x1c], 0x400000
je 0x1f9274ee
push eax
push 0x1f888abc
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.1f895d0a
mov eax, esi
pop esi
leave
ret
Function at 0x1f927ffb
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x1f92802b
push dword [ebp + 8]
push 0x54f
push 0x1f8884b4
push 0x341
push 0x1f888b18
call fcn.1f8a7bdf
xor eax, eax
jmp 0x1f928149
cmp dword [ebp + 0x18], edi
jne 0x1f928044
push dword [ebp + 8]
push 0x54f
push 0x1f888c64
push 0x342
jmp 0x1f92801a
push ebx
mov ebx, dword [ebp + 0x1c]
cmp ebx, edi
jne 0x1f92806f
push dword [ebp + 8]
push 0x54f
push 0x1f879420
push 0x343
push 0x1f888b18
call fcn.1f8a7bdf
xor eax, eax
jmp 0x1f928148
push esi
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegEnumKeyExW]
mov esi, eax
mov eax, 0x103
cmp esi, eax
jne 0x1f928098
push eax
jmp 0x1f92813a
cmp esi, edi
je 0x1f9280e1
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f9280c4
test dword [eax + 0x1c], 0x400000
je 0x1f9280c4
push esi
push 0x1f888abc
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x1f928139
mov ecx, dword [eax]
push esi
push 0x1f888c48
push 0x4033c364
push eax
call dword [ecx + 0x28]
add esp, 0x10
jmp 0x1f928139
push 0x1f87c74c
push dword [ebp + 0x18]
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
mov dword [ebx], eax
cmp eax, edi
jne 0x1f928144
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f92811e
test dword [eax + 0x1c], 0x400000
je 0x1f92811e
push 0x1f888abc
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895ce3
mov eax, dword [ebp + 8]
mov esi, 0x80338005
cmp eax, edi
je 0x1f928139
mov ecx, dword [eax]
push 0x4033c44a
push esi
push eax
call dword [ecx + 0x1c]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1f928147
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x1f928557
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x1f928587
push dword [ebp + 8]
push 0x54f
push 0x1f872da0
push 0x8f0
push 0x1f888b18
call fcn.1f8a7bdf
xor eax, eax
jmp 0x1f92868a
cmp dword [ebp + 0x18], esi
jne 0x1f9285a0
push dword [ebp + 8]
push 0x54f
push 0x1f888ccc
push 0x8f1
jmp 0x1f928576
cmp dword [ebp + 0x1c], esi
jne 0x1f9285b9
push dword [ebp + 8]
push 0x54f
push 0x1f888cc0
push 0x8f2
jmp 0x1f928576
push edi
push esi
push esi
push esi
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegEnumKeyExW]
mov edi, eax
mov eax, 0x103
cmp edi, eax
jne 0x1f9285e2
push eax
jmp 0x1f92867c
cmp edi, esi
je 0x1f92861d
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f92860e
test dword [eax + 0x1c], 0x400000
je 0x1f92860e
push edi
push 0x1f888abc
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1f92867b
push edi
push 0x1f888c48
jmp 0x1f92866d
push dword [ebp + 0x1c]
push 0x20119
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
je 0x1f928686
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f928660
test dword [eax + 0x1c], 0x400000
je 0x1f928660
push edi
push 0x1f888abc
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1f92867b
push edi
push 0x1f888030
mov ecx, dword [eax]
push 0x4033c364
push eax
call dword [ecx + 0x28]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1f928689
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x1f92902d
Capabilities:
Query or enumerate registry key

Disassembly:
push 8
mov eax, 0x1f968663
call fcn.1f8a600e
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp edi, esi
jne 0x1f929066
push esi
push 0x54f
push 0x1f888e5c
push 0x377
push 0x1f888b18
call fcn.1f8a7bdf
xor eax, eax
call fcn.1f8a60fa
ret 0xc
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f92908d
test dword [eax + 0x1c], 0x200000
je 0x1f92908d
push 0x1f888abc
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895ce3
push 2
pop edx
xor ecx, ecx
mov eax, 0x100
mov dword [ebp - 0x14], eax
mul edx
seto cl
push esi
neg ecx
or eax, ecx
lea ecx, [ebp + 0x13]
push ecx
push eax
call sym.WsmSvc.DLL_public:_static_void____stdcall_WSManMemory::Alloc_unsigned_int__class_TestSystem::CallSite_const___enum_TestSystem::Mode_
push eax
lea ecx, [ebp - 0x10]
call fcn.1f898885
mov dword [ebp - 4], esi
cmp dword [ebp - 0x10], esi
jne 0x1f9290d5
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1f8fe52c
jmp 0x1f92905c
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegEnumKeyExW]
mov ecx, 0x103
cmp eax, ecx
jne 0x1f9290f8
push ecx
jmp 0x1f9290c1
cmp eax, esi
je 0x1f929116
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1f8fe52c
mov eax, esi
jmp 0x1f92905e
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
xor eax, eax
inc eax
mov dword [ebp - 0x10], esi
mov dword [edi + 0xc], eax
mov esi, eax
jmp 0x1f929103
Function at 0x1f9331cc
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x1f97b198]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x814], eax
cmp ebx, esi
jne 0x1f933216
push esi
push 0x54f
push 0x1f87cf54
push 0x49c
push 0x1f88a3c8
call fcn.1f8a7bdf
xor eax, eax
jmp 0x1f9333f5
cmp eax, esi
jne 0x1f93322c
push ebx
push 0x54f
push 0x1f87cf48
push 0x49d
jmp 0x1f933205
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f933258
test dword [eax + 0x1c], 0x200000
je 0x1f933258
push 0x1f88a3b4
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895ce3
mov eax, dword [0x1f97b00c]
push edi
mov dword [ebp - 0x80c], esi
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x808], 1
mov edi, 0x54f
mov esi, 0x4033c360
xor ecx, ecx
cmp dword [ebp - 0x808], ecx
je 0x1f9333c0
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x810]
mov dword [ebp - 0x818], 0x400
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_RegEnumValueW]
test eax, eax
jne 0x1f933392
mov ecx, 0x1f88a468
lea eax, [ebp - 0x804]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1f9332ee
test dx, dx
je 0x1f9332ea
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1f9332ee
add eax, 4
add ecx, 4
test dx, dx
jne 0x1f9332c8
xor eax, eax
jmp 0x1f9332f3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1f933335
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f93332a
test dword [eax + 0x1c], 0x200000
je 0x1f93332a
lea ecx, [ebp - 0x804]
push ecx
push 0x1f88a3b4
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f8970b0
mov eax, dword [0x1f97b00c]
inc dword [ebp - 0x810]
jmp 0x1f933279
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_RegDeleteValueW]
test eax, eax
je 0x1f933354
push eax
push 0x1f88a448
jmp 0x1f93339f
inc dword [ebp - 0x80c]
mov eax, dword [0x1f97b00c]
cmp eax, 0x1f97b00c
je 0x1f933279
test dword [eax + 0x1c], 0x200000
je 0x1f933279
lea ecx, [ebp - 0x804]
push ecx
push 0x1f88a3b4
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f8970b0
jmp 0x1f9333b1
cmp eax, 0x103
je 0x1f9333bb
push eax
push 0x1f88a42c
mov ecx, dword [ebx]
push esi
push edi
push ebx
call dword [ecx + 0x1c]
add esp, 0x14
and dword [ebp - 0x808], 0
mov eax, dword [0x1f97b00c]
jmp 0x1f933279
mov eax, dword [0x1f97b00c]
pop edi
cmp eax, 0x1f97b00c
je 0x1f9333ef
test dword [eax + 0x1c], 0x200000
je 0x1f9333ef
push dword [ebp - 0x808]
push dword [ebp - 0x80c]
push 0x1f88a3b4
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f89f5b3
mov eax, dword [ebp - 0x808]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1f8a5ff9
leave
ret 8
Function at 0x1f934ad0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1f97b198]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x214], ecx
cmp eax, esi
jne 0x1f934b28
push esi
push 0x54f
push 0x1f873ab8
push 0x787
push 0x1f88a3c8
call fcn.1f8a7bdf
xor eax, eax
jmp 0x1f934c4b
cmp edx, esi
jne 0x1f934b3e
push eax
push 0x54f
push 0x1f88a6c0
push 0x788
jmp 0x1f934b17
cmp ecx, esi
jne 0x1f934b54
push eax
push 0x54f
push 0x1f888ca8
push 0x789
jmp 0x1f934b17
mov eax, dword [0x1f97b00c]
push ebx
mov ebx, 0x1f97b00c
push edi
cmp eax, ebx
je 0x1f934b7f
test dword [eax + 0x1c], 0x200000
je 0x1f934b7f
push 0x1f88a3b4
push 0x48
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895ce3
mov dword [ebp - 0x208], 1
cmp dword [ebp - 0x208], 1
jne 0x1f934c43
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x210], 0x100
call dword [sym.imp.KERNEL32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1f934be6
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x214]
push dword [ebp - 0x20c]
call fcn.1f934846
mov dword [ebp - 0x208], eax
jmp 0x1f934b89
cmp edi, 0x103
jne 0x1f934bfa
mov dword [ebp - 0x208], 1
jmp 0x1f934c43
cmp edi, esi
je 0x1f934c43
mov dword [ebp - 0x208], esi
mov eax, dword [0x1f97b00c]
cmp eax, ebx
je 0x1f934c29
test dword [eax + 0x1c], 0x400000
je 0x1f934c29
push edi
push 0x1f88a3b4
push 0x49
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1f895d0a
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push edi
push 0x1f888c48
push 0x4033c360
push eax
call dword [ecx + 0x28]
add esp, 0x10
mov eax, dword [ebp - 0x208]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1f8a5ff9
leave
ret 0x10