joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79215940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp + 8]
push ebx
sub esp, 0xa4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x7c], 0
test byte [0x7922a0c0], 8
jne 0x79215a50
lea eax, [ebp - 0x78]
lea edx, str._Z_y
call fcn.79227835
mov byte [ebp - 0x50], 0x30
mov edx, 2
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], sym._CRYPT_AsnDecodeAttributeTypeValue_28
mov dword [ebp - 0x44], 0xc
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0xc
mov dword [ebp - 0x28], sym._CRYPT_AsnDecodeSPCDigest_28
mov dword [ebp - 0x24], 0x14
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x50]
call sym._CRYPT_AsnDecodeSequence.isra.3
mov dword [ebp - 0x7c], eax
jmp 0x79215a31
mov eax, dword [ebp - 0x78]
mov dword fs:[0], eax
test byte [0x7922a0c0], 8
jne 0x79215aae
mov eax, dword [ebp - 0x7c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], str._p___d___08x___p___d_n
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x808
mov dword [esp + 0xc], 0x7922b4e0
mov dword [esp + 8], 0x7922b049
mov dword [esp + 4], 0x7922a0c0
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79215966
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0x14], 0x7922b062
mov dword [esp + 0x10], 0x820
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0x7922b4e0
mov dword [esp + 8], 0x7922b049
mov dword [esp + 4], 0x7922a0c0
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79215a43
Function at 0x79216d00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x7922a138], 8
jne 0x79216d60
test ebx, ebx
je 0x79216d41
cmp dword [ebx], 0x43415441
jne 0x79216d41
test esi, esi
je 0x79216d32
cmp word [esi], 0
jne 0x79216dc0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp], 0x57
call sym._SetLastError_4
xor eax, eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call sym._wine_dbgstr_wn
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], str._p__s__x_n
mov dword [esp + 0x10], 0x1df
mov dword [esp + 0xc], str.CryptCATAdminRemoveCatalog
mov dword [esp + 8], 0x7922b851
mov dword [esp + 4], 0x7922a138
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79216d18
mov dword [esp + 4], 0x5c
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
mov dword [esp], esi
call edi
test eax, eax
jne 0x79216d32
mov dword [esp + 4], 0x2f
mov dword [esp], esi
call edi
test eax, eax
jne 0x79216d32
mov dword [esp + 4], 0x3a
mov dword [esp], esi
call edi
test eax, eax
jne 0x79216d32
add ebx, 4
mov dword [esp], ebx
call sym._lstrlenW_4
push edi
mov dword [ebp - 0x14], eax
mov dword [esp], esi
call sym._lstrlenW_4
push edx
mov edi, eax
call sym._GetProcessHeap_0
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], 0
mov dword [esp], eax
lea edx, [edx + edi + 2]
add edx, edx
mov dword [esp + 8], edx
call sym._HeapAlloc_12
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x79216ea2
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._lstrcpyW_8
push eax
push eax
mov dword [esp + 4], 0x7922bf60
mov dword [esp], edi
call sym._lstrcatW_8
push edx
push edx
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._lstrcatW_8
push ecx
push ecx
mov dword [esp], edi
call sym._DeleteFileW_4
push ebx
call sym._GetProcessHeap_0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapFree_12
sub esp, 0xc
jmp 0x79216d32
mov dword [esp], 0xe
call sym._SetLastError_4
xor eax, eax
push esi
jmp 0x79216d52
Function at 0x7921a1f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x20], ecx
call sym._MultiByteToWideChar_24
mov edi, eax
sub esp, 0x18
add eax, eax
mov dword [esp], eax
call sym._WINTRUST_Alloc_4
sub esp, 4
mov esi, eax
mov dword [esp + 0x14], edi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._MultiByteToWideChar_24
sub esp, 0x18
mov dword [esp], str.SoftwareMicrosoftCryptographyProvidersTrust_
call sym._lstrlenW_4
sub esp, 4
mov ebx, eax
mov dword [esp], str.Usages_
call sym._lstrlenW_4
add ebx, eax
sub esp, 4
add edi, ebx
add edi, edi
mov dword [esp], edi
call sym._WINTRUST_Alloc_4
sub esp, 4
mov ebx, eax
mov dword [esp + 4], str.SoftwareMicrosoftCryptographyProvidersTrust_
mov dword [esp], eax
call sym._lstrcpyW_8
sub esp, 8
mov dword [esp + 4], str.Usages_
mov dword [esp], ebx
call sym._lstrcatW_8
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._lstrcatW_8
lea eax, [ebp - 0x14]
sub esp, 8
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call sym._RegCreateKeyExW_36
sub esp, 0x24
mov edi, eax
test eax, eax
je 0x7921a360
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov dword [esp], esi
call sym._WINTRUST_Free_4
sub esp, 4
mov dword [esp], ebx
call sym._WINTRUST_Free_4
mov eax, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sym._lstrlenW_4
sub esp, 4
lea eax, [eax + eax + 2]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp], eax
call sym._RegSetValueExW_24
sub esp, 0x18
mov edi, eax
jmp 0x7921a328
Function at 0x7921b600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
xor eax, eax
push ebx
lea ebx, [ebp - 0x420]
sub esp, 0x53c
mov word [ebp - 0x420], ax
mov dword [esp], ebx
mov dword [esp + 4], str.SoftwareMicrosoftCryptographyProvidersTrust_
call sym._lstrcatW_8
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], edi
call sym._lstrcatW_8
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], esi
call sym._lstrcatW_8
lea eax, [ebp - 0x52c]
sub esp, 8
mov dword [esp + 4], ebx
xor ebx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
jne 0x7921b6e1
mov eax, dword [ebp - 0x52c]
lea ebx, [ebp - 0x528]
lea esi, [ebp - 0x218]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str._DLL
mov dword [esp], eax
mov dword [ebp - 0x528], 0x208
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
je 0x7921b6f0
xor ebx, ebx
mov eax, dword [ebp - 0x52c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x52c]
mov dword [esp + 0x14], ebx
lea ebx, [ebp - 0x524]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x7922c160
mov dword [esp], eax
mov dword [ebp - 0x528], 0x104
call sym._RegQueryValueExA_24
sub esp, 0x18
test eax, eax
jne 0x7921b6ce
mov dword [esp], esi
call sym._LoadLibraryW_4
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov ebx, eax
jmp 0x7921b6d0

Function at 0x7921b760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0xb
mov ebp, esp
push edi
push esi
mov esi, eax
xor eax, eax
push ebx
lea ebx, [ebp - 0x40]
sub esp, 0x64
mov dword [ebp - 0x64], edx
lea edx, [ebp - 0x3c]
mov edi, edx
mov dword [ebp - 0x40], 0x30
rep stosd dword es:[edi], eax
mov dword [esp], 0x1a
call sym._WINTRUST_Alloc_4
lea ecx, [ebp - 0x5a]
xor edx, edx
mov dword [ebp - 0x3c], esi
sub esp, 4
mov word [ebp - 0x42], dx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x5a], 0x490057
mov dword [ebp - 0x56], 0x54004e
mov dword [ebp - 0x52], 0x550052
mov dword [ebp - 0x4e], 0x540053
mov dword [ebp - 0x4a], 0x44002e
mov dword [ebp - 0x46], 0x4c004c
call sym._lstrcpyW_8
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x30], 0
sub esp, 8
mov dword [ebp - 0x2c], 0x7922a260
mov dword [esp], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x7922a220
mov dword [ebp - 0x24], 0x7922a1e0
mov dword [ebp - 0x20], 0x7922a1a0
mov dword [ebp - 0x1c], 0x7922a160
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call sym._CryptSIPAddProvider_4
mov ebx, eax
mov eax, dword [ebp - 0x38]
sub esp, 4
mov dword [esp], eax
call sym._WINTRUST_Free_4
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x7921b840
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
xor eax, eax
push esi
mov esi, ecx
push ebx
lea ebx, [ebp - 0x218]
sub esp, 0x244
mov dword [ebp - 0x224], edx
mov dword [esp + 4], str.SoftwareMicrosoftCryptographyProvidersTrust_
mov dword [esp], ebx
mov word [ebp - 0x218], ax
call sym._lstrcatW_8
mov edx, dword [ebp - 0x224]
sub esp, 8
mov dword [esp + 4], edx
mov dword [esp], ebx
call sym._lstrcatW_8
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], ebx
call sym._lstrcatW_8
mov edx, dword [ebp + 8]
sub esp, 8
test edx, edx
je 0x7921b9b3
test esi, esi
je 0x7921b9b3
lea eax, [ebp - 0x21c]
mov dword [esp + 4], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
call sym._RegCreateKeyExW_36
sub esp, 0x24
mov ebx, eax
test eax, eax
je 0x7921b920
mov eax, dword [ebp - 0x21c]
mov dword [esp], eax
call sym._RegCloseKey_4
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call sym._lstrlenW_4
sub esp, 4
lea eax, [eax + eax + 2]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x21c]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str._DLL
mov dword [esp], eax
call sym._RegSetValueExW_24
sub esp, 0x18
mov ebx, eax
test eax, eax
jne 0x7921b902
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._lstrlenW_4
sub esp, 4
lea eax, [eax + eax + 2]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x21c]
mov dword [esp + 8], 0
mov dword [esp + 4], str._Function
mov dword [esp], eax
call sym._RegSetValueExW_24
sub esp, 0x18
mov ebx, eax
jmp 0x7921b902
lea esp, [ebp - 0xc]
mov ebx, 0x57
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x7921c840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0xa4]
push ebx
sub esp, 0xac
mov eax, dword [0x7922f0cc]
mov dword [ebp - 0xa4], 0x14
mov dword [ebp - 0xa0], 0x7922a2fc
mov dword [ebp - 0x70], eax
mov eax, dword [0x7922f0d0]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x6c], eax
mov eax, dword [0x7922f0d4]
mov dword [ebp - 0x98], 0x7922a2e0
mov dword [ebp - 0x68], eax
mov eax, dword [0x7922f0c0]
mov dword [ebp - 0x94], 0x7922a2c4
mov dword [ebp - 0x64], eax
mov eax, dword [0x7922f0c4]
mov dword [ebp - 0x74], 0x64
mov dword [ebp - 0x60], eax
mov eax, dword [0x7922f0c8]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x7922f0b4]
mov dword [ebp - 0x58], eax
mov eax, dword [0x7922f0b8]
mov dword [ebp - 0x54], eax
mov eax, dword [0x7922f0bc]
mov dword [ebp - 0x50], eax
mov eax, dword [0x7922f060]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x7922f064]
mov dword [ebp - 0x48], eax
mov eax, dword [0x7922f068]
mov dword [esp], 0x1a
mov dword [ebp - 0x44], eax
mov eax, dword [0x7922f09c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x40], eax
mov eax, dword [0x7922f0a0]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x3c], eax
mov eax, dword [0x7922f0a4]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x38], eax
mov eax, dword [0x7922f054]
mov dword [ebp - 0x34], eax
mov eax, dword [0x7922f058]
mov dword [ebp - 0x30], eax
mov eax, dword [0x7922f05c]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x7922f084]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x7922f088]
mov dword [ebp - 0x18], eax
mov eax, dword [0x7922f08c]
mov dword [ebp - 0x14], eax
call sym._WINTRUST_Alloc_4
xor edx, edx
mov dword [ebp - 0x8e], 0x490057
sub esp, 4
mov word [ebp - 0x76], dx
lea edx, [ebp - 0x8e]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x8a], 0x54004e
mov dword [ebp - 0x86], 0x550052
mov dword [ebp - 0x82], 0x540053
mov dword [ebp - 0x7e], 0x44002e
mov dword [ebp - 0x7a], 0x4c004c
call sym._lstrcpyW_8
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], str.1.3.6.1.5.5.7.3.1
call sym.wintrust.dll_WintrustAddDefaultForUsage
sub esp, 8
mov edi, eax
mov dword [esp + 4], esi
mov dword [esp], str.1.3.6.1.5.5.7.3.2
call sym.wintrust.dll_WintrustAddDefaultForUsage
sub esp, 8
mov ebx, eax
test eax, eax
je 0x7921c9e3
xor ebx, ebx
test edi, edi
setne bl
mov dword [esp + 4], esi
mov dword [esp], str.1.3.6.1.4.1.311.10.3.3
call sym.wintrust.dll_WintrustAddDefaultForUsage
sub esp, 8
cmp eax, 1
mov dword [esp + 4], esi
sbb eax, eax
mov dword [esp], str.2.16.840.1.113730.4.1
not eax
and ebx, eax
call sym.wintrust.dll_WintrustAddDefaultForUsage
sub esp, 8
cmp eax, 1
sbb eax, eax
not eax
and ebx, eax
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._WINTRUST_Free_4
lea eax, [ebp - 0x74]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x7922a2fc
call sym.wintrust.dll_WintrustAddActionID
sub esp, 0xc
cmp eax, 1
sbb eax, eax
lea esp, [ebp - 0xc]
not eax
and ebx, eax
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x7921f020
Capabilities:
Hash data via wincrypt
Read file on windows

Disassembly:
push ebp
sub ecx, edx
mov ebp, esp
push edi
push esi
mov esi, 0x100000
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [ebp - 0x1c], eax
cmp ecx, 0x100000
ja 0x7921f03f
mov esi, ecx
mov dword [ebp - 0x20], edx
call sym._GetProcessHeap_0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapAlloc_12
xor ecx, ecx
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x7921f128
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._SetFilePointer_16
sub esp, 0x10
test ebx, ebx
jne 0x7921f0d3
jmp 0x7921f132
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x7921f140
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_CryptHashData]
sub esp, 0x10
test eax, eax
je 0x7921f104
sub ebx, dword [ebp - 0x14]
je 0x7921f132
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, esi
cmp esi, ebx
jbe 0x7921f0ea
mov eax, ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
jne 0x7921f0a0
mov ecx, eax
mov dword [ebp - 0x1c], ecx
call sym._GetProcessHeap_0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapFree_12
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 1
jmp 0x7921f106
xor ecx, ecx
jmp 0x7921f106
Function at 0x7921f710
Capabilities:
Get geographical location

Disassembly:
test eax, eax
je 0x7921f793
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x60]
lea esi, [ebp - 0x70]
push ebx
mov ebx, eax
sub esp, 0x7c
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x50
mov dword [esp + 4], 0x1f
mov dword [esp], 0x800
call sym._GetLocaleInfoA_16
sub esp, 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._FileTimeToSystemTime_8
sub esp, 8
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0x50
mov dword [esp + 0x10], 0x7922f0e0
mov dword [esp + 4], 0
mov dword [esp], 0x800
call sym._GetDateFormatA_24
mov eax, 0x7922f0e0
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
ret
Function at 0x79222e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
test byte [0x7922a4a0], 8
jne 0x79222f45
lea eax, [ebp - 0xc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionWintrustTrust_ProvidersSoftware_Publishing
mov dword [esp], 0x80000001
call sym._RegCreateKeyExW_36
sub esp, 0x24
mov ebx, eax
test eax, eax
je 0x79222ef0
mov dword [esp], ebx
call sym._SetLastError_4
xor eax, eax
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret 4
lea eax, [ebp + 8]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.State
mov dword [esp], eax
call sym._RegSetValueExW_24
mov ebx, eax
mov eax, dword [ebp - 0xc]
sub esp, 0x18
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
test ebx, ebx
jne 0x79222ed8
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 4
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0x7922d10b
mov dword [esp + 0x10], 0x3d5
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], str.WintrustSetRegPolicyFlags
mov dword [esp + 8], 0x7922cfc1
mov dword [esp + 4], 0x7922a4a0
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79222e84

Function at 0x79222f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 8]
test byte [0x7922a4a0], 8
jne 0x79223005
lea eax, [ebp - 0x10]
mov dword [ebx], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20019
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionWintrustTrust_ProvidersSoftware_Publishing
mov dword [esp], 0x80000001
call sym._RegCreateKeyExW_36
sub esp, 0x24
test eax, eax
je 0x79223042
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0x7922d079
mov dword [esp + 0x10], 0x3b4
mov dword [esp + 0xc], str.WintrustGetRegPolicyFlags
mov dword [esp + 8], 0x7922cfc1
mov dword [esp + 4], 0x7922a4a0
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79222fa4
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.State
mov dword [esp], eax
mov dword [ebp - 0xc], 4
call sym._RegQueryValueExW_24
mov esi, eax
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
test esi, esi
je 0x79222ffc
mov dword [ebx], 0x23c00
mov dword [esp], HeapReAlloc
call sym.wintrust.dll_WintrustSetRegPolicyFlags
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x79225730
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_AddPersonalTrustDBPages___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7922d991
mov dword [ebp - 0x40], str.AddPersonalTrustDBPages
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x79225790
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CatalogCompactHashDatabase___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7922d991
mov dword [ebp - 0x40], str.CatalogCompactHashDatabase
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x792257f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CryptCATAdminPauseServiceForBackup___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7922d991
mov dword [ebp - 0x40], str.CryptCATAdminPauseServiceForBackup
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x79225850
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CryptCATCDFEnumAttributes___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7922d991
mov dword [ebp - 0x40], str.CryptCATCDFEnumAttributes
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x792258b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CryptCATCDFEnumAttributesWithCDFTag___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x7922d991
mov dword [ebp - 0x40], str.CryptCATCDFEnumAttributesWithCDFTag
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4