joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb8b7fb
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathGetArgsW]
mov ebx, eax
push 2
pop esi
test ebx, ebx
je 0xb8b830
cmp word [ebx], 0
jne 0xbd3720
call fcn.00b8b656
test eax, eax
je 0xb8b851
call fcn.00b8c2ee
test eax, eax
jne 0xb8b864
push 0x1e
call dword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
test eax, eax
jne 0xb8b864
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
push 5
pop esi
jmp 0xb8b851
push 1
or edi, 0xffffffff
push edi
push 0xb2b108
push edi
push ebx
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, esi
je 0xb8b830
push 1
push edi
push 0xb3e238
push edi
push ebx
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, esi
je 0xb8b830
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x20]
mov ecx, ebx
call fcn.00c248fb
test eax, eax
je 0xb8b851
push 0x10
lea eax, [ebp - 0x14]
push 0xb28b08
push eax
call fcn.00bc6363
add esp, 0xc
xor ebx, ebx
test eax, eax
sete bl
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
movzx eax, bl
xor eax, 1
lea esi, [eax*2 + 2]
jmp 0xb8b851
Function at 0xb8c3f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
mov eax, dword [0xd08954]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
push 0xb26644
push ecx
xor ebx, ebx
mov esi, ecx
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call fcn.00b8d992
push 0xb2666c
push ecx
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00b8d992
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00b8ac11
mov ecx, dword [esi + 0x18]
call fcn.00b8adb7
cmp dword [esp + 0x10], ebx
jne 0xbd3c54
push 0xcbd230
call fcn.00b8b3e7
mov edi, dword [eax + 4]
cmp dword [edi], 5
jbe 0xb8c5ac
push 0x8000
push ebx
mov ecx, edi
call fcn.00b54cc0
test al, al
je 0xb8c5ac
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x58], eax
lea eax, [ebp + 8]
mov dword [esp + 0x68], eax
lea eax, [ebp + 0xc]
mov dword [esp + 0x78], eax
movzx eax, byte [ebp + 0x10]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x88], eax
movzx eax, byte [ebp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x98], eax
movzx eax, byte [ebp + 0x18]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb4], ebx
push 4
pop ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xb0], ecx
test edx, edx
je 0xb8c5e2
lea ecx, [esp + 0xb8]
call fcn.00b52bec
mov edx, dword [esp + 0x20]
test edx, edx
je 0xb8c5e9
lea ecx, [esp + 0xc8]
call fcn.00b52bec
lea eax, [esp + 0x38]
mov ecx, esi
push eax
push 0xa
call fcn.00bc0711
push eax
mov eax, dword [esi + 0x18]
mov edx, 0xb3ba0c
add eax, 8
mov ecx, edi
push eax
call fcn.00b809fe
cmp dword [esi + 0x10], ebx
jne 0xb8c5b9
lea ecx, [esi + 4]
call fcn.00b549f6
lea ecx, [esp + 0x20]
call fcn.00b7a9bd
lea ecx, [esp + 0x2c]
call fcn.00b7a9bd
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0x14
mov edx, 0xb284a8
jmp 0xb8c56a
mov edx, 0xb284a8
jmp 0xb8c57e
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
jmp 0xb8c472
Function at 0xb8d847
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
lea eax, [ebp - 8]
mov edi, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jg 0xbd47e6
js 0xb8d8fb
cmp dword [ebp - 8], 1
mov eax, dword [ebp - 4]
jne 0xbd47f6
test eax, eax
je 0xbd4800
test al, 1
jne 0xbd4800
test esi, esi
js 0xb8d8fb
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov edi, eax
test edi, edi
je 0xb8d90d
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jg 0xbd480a
js 0xb8d8fb
mov ebx, dword [ebp - 4]
shr ebx, 1
dec ebx
cmp dword [ebp - 8], 2
je 0xbd481a
test esi, esi
js 0xb8d8fb
xor eax, eax
cmp word [edi + ebx*2], ax
jne 0xb8d914
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + 1]
push eax
push edi
call fcn.00b8d815
xor eax, eax
mov edi, eax
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, 0x8007000e
jmp 0xb8d8fb
mov esi, 0x8007000d
jmp 0xb8d8fb
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xb8d87c
cmp dword [ebp - 8], 2
je 0xb8d88b
mov esi, 0x8007000d
jmp 0xb8d89b
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xb8d8cc
xor eax, eax
push eax
push eax
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0xb8d8de
lea ecx, [eax + eax]
push ecx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0xb8d90d
mov esi, dword [ebp - 0x10]
push esi
push eax
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0xbd4871
cmp eax, esi
ja 0xbd4871
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
dec ebx
jmp 0xb8d8e2
push dword [ebp - 0xc]
mov esi, 0x8007007a
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xb8d8de
Function at 0xb8e8b0
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0xb26b90
push 0xb26b70
push dword [edi - 0xc]
call dword [sym.imp.api_ms_win_shcore_comhelpers_l1_1_0.dll_IUnknown_QueryService]
mov ebx, dword [ebp + 0xc]
test eax, eax
jns 0xbd4bdb
mov eax, dword [ebx]
lea ecx, [ebp - 8]
push ecx
push ebx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
js 0xb8e969
test dword [0xd0a5c0], 0x2000
je 0xb8e927
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
push eax
mov edx, 0xb26ba0
mov ecx, 0xd08200
call fcn.00b8eed4
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push ebx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
js 0xb8e960
mov ebx, dword [ebp - 0x10]
xor eax, eax
mov esi, dword [ebp - 8]
cmp dword [edi + 8], eax
jne 0xbd4c07
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
push ebx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb8e8ea
cmp dword [edi + 0xc], eax
je 0xb8e950
cmp dword [edi + 0x10], eax
jne 0xbd4c2e
lea eax, [edi + 0x14]
push eax
push esi
call fcn.00c22a13
test eax, eax
js 0xb8e950
mov dword [edi + 0x10], 1
push esi
push dword [edi + 8]
call dword [sym.imp.api_ms_win_core_job_l2_1_0.dll_AssignProcessToJobObject]
test eax, eax
jne 0xbd4c47
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb8e950
push 0
lea eax, [edi + 0x20]
push eax
push esi
call fcn.00c22a8a
test eax, eax
jns 0xb8e950
push 1
lea eax, [edi + 0x14]
push eax
push esi
call fcn.00c22a8a
jmp 0xb8e950

Function at 0xb8e9fc
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push esi
push 0xbc03e0
push edi
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test eax, eax
je 0xbd4d8e
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
pop edi
pop esi
ret
mov dword [esi + 0x1c], edi
mov ecx, esi
pop edi
pop esi
jmp fcn.00b8e97e
Function at 0xb8ea26
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push ebx
push 0x10
push 0xb2b358
push ebx
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb8ea65
mov eax, dword [ebp - 8]
cmp eax, 0x418937
jae 0xb8ea65
mov dword [esi + 0x1c], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0xb2b04c
push ebx
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb8ea9b
mov eax, dword [ebp - 8]
cmp eax, 0x4000
jne 0xbd4d9a
mov dword [esi + 0x30], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0xb2b194
push ebx
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb8eacb
mov eax, dword [ebp - 8]
cmp eax, 2
ja 0xb8eacb
mov dword [esi + 0x34], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0xb2b0e4
push ebx
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb8eb00
mov eax, dword [ebp - 8]
cmp eax, 8
jae 0xb8eb00
cmp eax, 5
ja 0xb8eb00
mov dword [esi + 0x38], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x20
je 0xb8ea98
cmp eax, 0x40
jne 0xb8ea9b
jmp 0xb8ea98
Function at 0xb8fb18
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc84
mov eax, dword [0xd08954]
xor eax, esp
mov dword [esp + 0xc80], eax
push ebx
push esi
push edi
mov edi, 0x104
lea eax, [esp + 0x260]
push edi
push eax
push 0
push 0
push 0xb27500
call dword [sym.imp.api_ms_win_storage_exports_internal_l1_1_0.dll_SHGetFolderPathEx]
test eax, eax
jne 0xb8fbde
push 0x20
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrChrW]
mov esi, eax
test esi, esi
je 0xb8fbde
lea eax, [esp + 0x260]
mov edx, edi
push eax
lea ecx, [esp + 0x674]
call fcn.00b7db60
xor eax, eax
lea ecx, [esp + 0xa80]
mov word [esi], ax
mov edx, edi
lea eax, [esp + 0x260]
push eax
call fcn.00b7db60
lea ecx, [esp + 0x260]
mov eax, esi
sub eax, ecx
mov edx, edi
sar eax, 1
mov ecx, esi
push 0xb274f8
sub edx, eax
call fcn.00b7db60
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0xbd5845
mov ecx, dword [esp + 0xc8c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x260]
mov edx, edi
push eax
lea ecx, [esp + 0x46c]
call fcn.00b7db60
lea eax, [esp + 0x468]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x3c]
mov edx, edi
push eax
lea ecx, [esp + 0x46c]
call fcn.00b80376
mov eax, dword [esp + 0x10]
xor edi, edi
and eax, 0x410
cmp eax, 0x410
jne 0xbd5900
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x470]
call fcn.00c291a1
test eax, eax
js 0xbd5900
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x878]
push edi
push edi
push 0x104
mov esi, dword [eax]
push ecx
push eax
mov ecx, dword [esi + 0xc]
call dword [0xd0cffc]
call dword [esi + 0xc]
test eax, eax
jne 0xbd58ec
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x678]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x888]
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
jne 0xbd58ec
inc edi
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
test byte [esp + 0x10], 0x10
je 0xbd5921
lea eax, [esp + 0x468]
push eax
lea eax, [esp + 0xa84]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0xbd5953
test edi, edi
jne 0xbd5953
push 0xb3ed98
push 5
lea eax, [esp + 0x470]
push eax
push 0xc34bb0
push 0x14
push dword [0xd0a648]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetDesktopWindow]
push eax
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_292]
cmp eax, 5
je 0xbd596d
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0xbd596d
mov edi, 0x104
jmp 0xbd5845
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
jmp 0xb8fbde
Function at 0xb90466
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call fcn.00b90ba3
push 0xb27790
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_RegisterWindowMessageW]
push 0xb27758
mov dword [esi + 0x154], eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_RegisterWindowMessageW]
mov edx, dword [esi + 0x1e0]
mov dword [esi + 0x158], eax
push edx
mov eax, dword [edx]
mov edi, dword [eax + 0x2c]
cmp edi, fcn.00ba6290
jne 0xbd5d12
call fcn.00ba6290
xor edi, edi
push edi
push edi
push 0xb27720
push 0xb28430
call dword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
test eax, eax
setne al
mov byte [esi + 0x104], al
call fcn.00bbc0a8
push esi
push dword [0xd0a648]
neg eax
push edi
push edi
push edi
push edi
push edi
push edi
push 0x82000000
sbb eax, eax
push edi
and eax, 0x400000
add eax, 0x180
push 0xb27ee8
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_CreateWindowExW]
call fcn.00b84bd5
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
mov ecx, edi
call dword [0xd0cffc]
call edi
jmp 0xb904be

Function at 0xb90d38
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push ecx
call fcn.00bbd42d
mov esi, 0xd0a500
mov ecx, esi
call fcn.00b51e69
push esi
mov ecx, 0xd0a33c
call fcn.00bbc31a
test eax, eax
js 0xbd5dfe
mov eax, dword [0xd0a5e0]
mov edx, fcn.00b917b0
test eax, eax
jne 0xbd5e16
push 0xbc0420
push 0x282a
push 0xd0a320
push 0xbbffa0
mov dword [0xd0a5e0], edx
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
test eax, eax
je 0xb90daa
cmp dword [0xd0a324], 0
je 0xb90daa
xor eax, eax
inc eax
pop esi
pop ecx
pop ebp
ret
xor eax, eax
jmp 0xb90da6
mov ecx, dword [ebp + 4]
mov edx, 0x167
push eax
push 0xb2b1d4
call fcn.00b913f8
jmp 0xb90daa
cmp eax, edx
je 0xb90d76
push 7
pop ecx
int 0x29
jmp 0xb90d76
Function at 0xb90f43
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, esi
mov dword [ebp - 8], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ecx], 0
je 0xb90fc8
cmp dword [ecx], 1
je 0xb90fb4
cmp dword [ecx], 2
je 0xbd5e83
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xc
push eax
push esi
xor edi, edi
push edi
push 0x20000008
push dword [ebp + 8]
push edi
push dword [ecx]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
cmp ebx, 0xea
je 0xbd5e90
test ebx, ebx
je 0xb90fa9
cmp ebx, 2
jne 0xbd5ee7
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ecx + 4]
push 2
pop eax
cmp ebx, 1
je 0xb90fd0
dec ebx
neg ebx
sbb ebx, ebx
and ebx, eax
jmp 0xb90fa9
push 0x15
pop ebx
jmp 0xbd5ef3
mov dword [esi], eax
jmp 0xb90fbf
mov dword [esi], 3
xor ebx, ebx
jmp 0xb90fa9
push dword [ebp - 4]
push edi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0xbd5edf
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push edi
push 0
push 0x20000008
push dword [ebp + 8]
push 0
push dword [eax]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test ebx, ebx
jne 0xbd5ed3
mov esi, edi
mov edi, dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0xc]
push edi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xb90f9c
push 0xe
pop ebx
jmp 0xb90f9c
cmp ebx, 0x65e
je 0xb90fa9
mov dword [esi], 2
jmp 0xb90fa9
Function at 0xb91156
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40000047
mov edi, ecx
xor esi, esi
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0xb9129f
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
jne 0xb9129f
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
inc ebx
push ebx
push esi
push 0xb277d0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xb9129e
push edi
lea ecx, [ebp - 0x214]
call fcn.00b8c381
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x1fe
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0xb277c0
push esi
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
mov edi, 0x4000
test eax, eax
jne 0xb9124d
cmp dword [ebp - 0x20c], ebx
jne 0xb9124d
test dword [0xd0a5c0], edi
je 0xb9121e
push 0xb26f20
mov edx, 0xb269b0
call fcn.00b90dd1
push dword [ebp - 0x214]
lea ecx, [ebp - 0x204]
push 7
pop edx
call fcn.00b92bf9
test eax, eax
jne 0xb912b1
test dword [0xd0a5c0], edi
je 0xb9124d
push 0xb26f20
mov edx, 0xb269c0
call fcn.00b90dd1
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x1fe
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0xb277b8
push 0
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
je 0xbd5fd5
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea ecx, [ebp - 0x214]
call fcn.00b8d42a
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
mov esi, ebx
jmp 0xb91236
cmp dword [ebp - 0x20c], ebx
jne 0xb91287
test dword [0xd0a5c0], edi
je 0xbd5ff8
push 0xb49ca0
mov edx, 0xb269b0
call fcn.00b90dd1
push dword [ebp - 0x214]
mov edx, ebx
lea ecx, [ebp - 0x204]
call fcn.00b92bf9
test eax, eax
je 0xbd6011
mov esi, ebx
test dword [0xd0a5c0], edi
je 0xb91287
push 0xb49ca0
mov edx, 0xb269c0
call fcn.00b90dd1
jmp 0xb91287
Function at 0xb91896
Capabilities:
Persist via run registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea edx, [ebp - 4]
xor esi, esi
call fcn.00b91952
test eax, eax
js 0xb9190f
cmp dword [ebp - 4], 1
ja 0xb9190f
push edi
push 0x40000048
call dword [sym.imp.SHELL32.dll_SHRestricted]
push ecx
mov edi, eax
call fcn.00b91920
test eax, eax
jne 0xb91916
test edi, edi
jne 0xb9190e
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0xb26c10
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xb9190e
push esi
lea eax, [ebp - 8]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHQueryInfoKeyW]
test eax, eax
jne 0xb91905
cmp dword [ebp - 8], esi
ja 0xb9191b
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
inc esi
jmp 0xb9190e
xor esi, esi
inc esi
jmp 0xb91905

Function at 0xb91920
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 9
push ebx
push 0xb26fe0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xbd63d9
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0xbd63fc
xor ebx, ebx
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xb91949

Function at 0xb91c26
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
mov dword [ebx], 2
test edi, edi
je 0xb91c44
mov dword [edi], esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x10
push edx
push 0xb27048
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xbd64b2
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
ja 0xb91c79
mov dword [ebx], esi
test edi, edi
je 0xb91c7f
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 2
jne 0xbd64c2
mov dword [ebx], 1
jmp 0xb91c7f
test eax, eax
jg 0xbd64cd
mov esi, eax
jmp 0xb91c7f
movzx esi, ax
or esi, 0xc0070000
jmp 0xb91c7f

Function at 0xb91f80
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
call fcn.00b922d6
test al, al
jne 0xb91fb6
mov eax, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
push ebx
push 0x2008
push ebx
push 0xb93c40
mov dword [eax + 0x17c], ecx
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
mov al, bl
pop ebx
pop ebp
ret 8
mov bl, 1
jmp 0xb91faf