joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa1fd60
Capabilities:
Get file attributes

Disassembly:
mov al, byte [0xaf474d]
sub esp, 0x104
test al, al
je 0xa1fd86
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x104
ret 4
push esi
push edi
mov edi, dword [esp + 0x110]
test edi, edi
jne 0xa1fd9c
mov dword [esp + 0x108], edi
jmp 0xa1fe13
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa1fde7
push 0
push 0
lea ecx, [esp + 0x18]
push 0x100
push ecx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa1fde7
lea edx, [esp + 0x10]
mov dword [esp + 0x110], edx
jmp 0xa1fe0a
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x110], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0xa1fe3f
lea ecx, [esp + 8]
cmp eax, ecx
je 0xa1fe3f
push eax
call fcn.00a1fd20
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret 4

Function at 0xa1ffe0
Capabilities:
Create directory

Disassembly:
mov al, byte [0xaf474d]
sub esp, 0x104
test al, al
je 0xa2000e
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0x104
ret 8
push esi
push edi
mov edi, dword [esp + 0x110]
test edi, edi
jne 0xa20024
mov dword [esp + 0x108], edi
jmp 0xa2009b
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa2006f
push 0
push 0
lea edx, [esp + 0x18]
push 0x100
push edx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa2006f
lea eax, [esp + 0x10]
mov dword [esp + 0x110], eax
jmp 0xa20092
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x110], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x108]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0xa200cf
lea ecx, [esp + 8]
cmp eax, ecx
je 0xa200cf
push eax
call fcn.00a1fd20
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret 8
Function at 0xa200e0
Capabilities:
Delete directory

Disassembly:
mov al, byte [0xaf474d]
sub esp, 0x104
test al, al
je 0xa20106
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add esp, 0x104
ret 4
push esi
push edi
mov edi, dword [esp + 0x110]
test edi, edi
jne 0xa2011c
mov dword [esp + 0x108], edi
jmp 0xa20193
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa20167
push 0
push 0
lea ecx, [esp + 0x18]
push 0x100
push ecx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa20167
lea edx, [esp + 0x10]
mov dword [esp + 0x110], edx
jmp 0xa2018a
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x110], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0xa201bf
lea ecx, [esp + 8]
cmp eax, ecx
je 0xa201bf
push eax
call fcn.00a1fd20
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret 4

Function at 0xa201d0
Capabilities:
Set current directory

Disassembly:
mov al, byte [0xaf474d]
sub esp, 0x104
test al, al
je 0xa201f6
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
add esp, 0x104
ret 4
push esi
push edi
mov edi, dword [esp + 0x110]
test edi, edi
jne 0xa2020c
mov dword [esp + 0x108], edi
jmp 0xa20283
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa20257
push 0
push 0
lea ecx, [esp + 0x18]
push 0x100
push ecx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa20257
lea edx, [esp + 0x10]
mov dword [esp + 0x110], edx
jmp 0xa2027a
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x110], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0xa202af
lea ecx, [esp + 8]
cmp eax, ecx
je 0xa202af
push eax
call fcn.00a1fd20
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret 4
Function at 0xa202c0
Capabilities:
Query environment variable

Disassembly:
mov al, byte [0xaf474d]
sub esp, 0x108
test al, al
je 0xa202f6
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 0x108
ret 0xc
push ebp
push esi
push edi
push 0x8000
call fcn.009ef380
mov edi, dword [esp + 0x11c]
add esp, 4
test edi, edi
mov ebp, eax
jne 0xa2031c
mov dword [esp + 0x110], edi
jmp 0xa20397
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [esp + 0x14], eax
call fcn.00a7e07a
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa20368
push 0
push 0
lea eax, [esp + 0x1c]
push 0x100
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa20368
lea ecx, [esp + 0x14]
mov dword [esp + 0x114], ecx
jmp 0xa2038b
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x114], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
mov eax, dword [esp + 0x110]
push 0x8000
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
mov eax, dword [esp + 0x110]
test eax, eax
je 0xa203c9
lea ecx, [esp + 0x10]
cmp eax, ecx
je 0xa203c9
push eax
call fcn.00a1fd20
add esp, 4
test esi, esi
je 0xa203ec
mov edx, dword [esp + 0x120]
mov eax, dword [esp + 0x11c]
push edx
push eax
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
push ebp
call fcn.00a7d8f0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x108
ret 0xc
Function at 0xa20410
Capabilities:
Set environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b61b
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x20c
test al, al
je 0xa20461
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
test esi, esi
jne 0xa20483
mov dword [esp + 0x218], 0
jmp 0xa204f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebp, eax
call fcn.00a7e07a
mov edi, eax
add esp, 4
cmp edi, 0xff
jg 0xa204cc
push 0
push 0
lea edx, [esp + 0x120]
push 0x100
push edx
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
test eax, eax
je 0xa204cc
lea eax, [esp + 0x118]
mov dword [esp + 0x218], eax
jmp 0xa204ef
lea edi, [edi + edi*2 + 3]
push edi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x218], eax
push 0
push 0
push edi
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x22c]
mov ecx, dword [esp + 0x218]
xor eax, eax
mov dword [esp + 0x10], ecx
cmp edi, eax
mov dword [esp + 0x224], eax
jne 0xa2051e
mov dword [esp + 0x114], eax
jmp 0xa2058b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa20561
push 0
push 0
lea edx, [esp + 0x1c]
push 0x100
push edx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa20561
lea eax, [esp + 0x14]
mov dword [esp + 0x114], eax
jmp 0xa20584
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x114], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x114]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, eax
mov eax, dword [esp + 0x114]
test eax, eax
je 0xa205bc
lea ecx, [esp + 0x14]
cmp eax, ecx
je 0xa205bc
push eax
call fcn.00a1fd20
add esp, 4
mov eax, dword [esp + 0x218]
mov dword [esp + 0x224], 0xffffffff
test eax, eax
je 0xa205e6
lea edx, [esp + 0x118]
cmp eax, edx
je 0xa205e6
push eax
call fcn.00a1fd20
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x218
ret 8
Function at 0xa20610
Capabilities:
Delete file

Disassembly:
mov al, byte [0xaf474d]
sub esp, 0x104
test al, al
je 0xa20636
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x104
ret 4
push esi
push edi
mov edi, dword [esp + 0x110]
test edi, edi
jne 0xa2064c
mov dword [esp + 0x108], edi
jmp 0xa206c3
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa20697
push 0
push 0
lea ecx, [esp + 0x18]
push 0x100
push ecx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa20697
lea edx, [esp + 0x10]
mov dword [esp + 0x110], edx
jmp 0xa206ba
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x110], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
mov eax, dword [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0xa206ef
lea ecx, [esp + 8]
cmp eax, ecx
je 0xa206ef
push eax
call fcn.00a1fd20
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret 4
Function at 0xa20700
Capabilities:
Copy file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b63b
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x20c
test al, al
je 0xa20759
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x220]
mov edx, dword [esp + 0x21c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
test esi, esi
jne 0xa2077b
mov dword [esp + 0x218], 0
jmp 0xa207ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebp, eax
call fcn.00a7e07a
mov edi, eax
add esp, 4
cmp edi, 0xff
jg 0xa207c4
push 0
push 0
lea eax, [esp + 0x120]
push 0x100
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
test eax, eax
je 0xa207c4
lea ecx, [esp + 0x118]
mov dword [esp + 0x218], ecx
jmp 0xa207e7
lea edi, [edi + edi*2 + 3]
push edi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x218], eax
push 0
push 0
push edi
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x22c]
mov edx, dword [esp + 0x218]
xor eax, eax
mov dword [esp + 0x10], edx
cmp edi, eax
mov dword [esp + 0x224], eax
jne 0xa20816
mov dword [esp + 0x114], eax
jmp 0xa20883
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa20859
push 0
push 0
lea eax, [esp + 0x1c]
push 0x100
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa20859
lea ecx, [esp + 0x14]
mov dword [esp + 0x114], ecx
jmp 0xa2087c
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x114], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x234]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x114]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
mov eax, dword [esp + 0x114]
test eax, eax
je 0xa208bc
lea edx, [esp + 0x14]
cmp eax, edx
je 0xa208bc
push eax
call fcn.00a1fd20
add esp, 4
mov eax, dword [esp + 0x218]
mov dword [esp + 0x224], 0xffffffff
test eax, eax
je 0xa208e6
lea ecx, [esp + 0x118]
cmp eax, ecx
je 0xa208e6
push eax
call fcn.00a1fd20
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x218
ret 0xc
Function at 0xa20910
Capabilities:
Get common file path

Disassembly:
mov al, byte [0xaf474d]
test al, al
je 0xa2092c
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
ret 8
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
lea edx, [ebx + ebx]
push edx
call fcn.00a7e295
add esp, 4
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
test edi, edi
je 0xa20964
mov eax, dword [esp + 0x14]
push ebx
lea ecx, [edi + 1]
push eax
push ecx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
call fcn.00a7e9ce
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
ret 8

Function at 0xa20980
Capabilities:
Set file attributes

Disassembly:
mov al, byte [0xaf474d]
sub esp, 0x104
test al, al
je 0xa209ae
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 0x104
ret 8
push esi
push edi
mov edi, dword [esp + 0x110]
test edi, edi
jne 0xa209c4
mov dword [esp + 0x108], edi
jmp 0xa20a3b
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebp, eax
call fcn.00a7e07a
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
add esp, 4
cmp esi, 0xff
jg 0xa20a0f
push 0
push 0
lea edx, [esp + 0x18]
push 0x100
push edx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
test eax, eax
je 0xa20a0f
lea eax, [esp + 0x10]
mov dword [esp + 0x110], eax
jmp 0xa20a32
lea esi, [esi + esi*2 + 3]
push esi
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x110], eax
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x108]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0xa20a6f
lea ecx, [esp + 8]
cmp eax, ecx
je 0xa20a6f
push eax
call fcn.00a1fd20
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret 8
Function at 0xa21b30
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b6db
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x218
test al, al
push ebx
push ebp
je 0xa21ba1
mov eax, dword [esp + 0x24c]
mov ecx, dword [esp + 0x248]
mov edx, dword [esp + 0x244]
push eax
mov eax, dword [esp + 0x244]
push ecx
mov ecx, dword [esp + 0x244]
push edx
mov edx, dword [esp + 0x244]
push eax
mov eax, dword [esp + 0x244]
push ecx
mov ecx, dword [esp + 0x244]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0xa21d59
mov ebx, dword [esp + 0x23c]
xor ebp, ebp
cmp ebx, ebp
jne 0xa21bb8
mov eax, 0x57
jmp 0xa21d59
mov eax, dword [ebx]
cmp eax, 0x100
mov dword [esp + 0xc], eax
jae 0xa21bd2
lea edx, [esp + 0x18]
mov dword [esp + 0x118], edx
jmp 0xa21bef
cmp eax, ebp
je 0xa21be8
push eax
call fcn.00a1fcf0
add esp, 4
mov dword [esp + 0x118], eax
jmp 0xa21bef
mov dword [esp + 0x118], ebp
push esi
push edi
mov esi, dword [esp + 0x250]
mov dword [esp + 0x230], ebp
cmp esi, ebp
mov dword [esp + 0x10], ebp
je 0xa21c14
mov eax, dword [esi]
cmp eax, 0x100
mov dword [esp + 0x10], eax
jae 0xa21c1d
lea eax, [esp + 0x124]
jmp 0xa21c2e
cmp eax, ebp
je 0xa21c2c
push eax
call fcn.00a1fcf0
add esp, 4
jmp 0xa21c2e
xor eax, eax
mov ecx, dword [esp + 0x254]
mov edx, esi
neg edx
push ecx
lea ecx, [esp + 0x14]
sbb edx, edx
mov dword [esp + 0x228], eax
and edx, ecx
mov ecx, dword [esp + 0x124]
push edx
mov edx, dword [esp + 0x250]
push eax
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x24c]
push eax
mov eax, dword [esp + 0x24c]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, eax
cmp edi, ebp
mov dword [esp + 0x1c], edi
je 0xa21c8c
cmp edi, 0xea
jne 0xa21d0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx]
mov edi, dword [esp + 0x240]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x120]
push ecx
push edi
push edx
push eax
push ebp
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call ebp
cmp eax, dword [ebx]
jge 0xa21cc2
mov word [edi + eax*2], 0
test esi, esi
mov dword [ebx], eax
je 0xa21cfe
mov edi, dword [esp + 0x24c]
test edi, edi
je 0xa21cf8
mov ecx, dword [esi]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x224]
push ecx
push edi
push edx
push eax
push 0
push 0
call ebp
cmp eax, dword [esi]
jge 0xa21cf4
mov word [edi + eax*2], 0
mov dword [esi], eax
jmp 0xa21cfe
mov ecx, dword [esp + 0x10]
mov dword [esi], ecx
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebp, ebp
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x224]
cmp eax, ebp
je 0xa21d2e
lea ecx, [esp + 0x124]
cmp eax, ecx
je 0xa21d2e
push eax
call fcn.00a1fd20
add esp, 4
mov eax, dword [esp + 0x120]
mov dword [esp + 0x230], 0xffffffff
cmp eax, ebp
je 0xa21d55
lea edx, [esp + 0x20]
cmp eax, edx
je 0xa21d55
push eax
call fcn.00a1fd20
add esp, 4
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x220]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret 0x20
Function at 0xa22010
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b71b
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x114
test al, al
je 0xa220b1
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x14c]
mov edx, dword [esp + 0x148]
push eax
mov eax, dword [esp + 0x148]
push ecx
mov ecx, dword [esp + 0x148]
push edx
mov edx, dword [esp + 0x148]
push eax
mov eax, dword [esp + 0x148]
push ecx
mov ecx, dword [esp + 0x148]
push edx
mov edx, dword [esp + 0x148]
push eax
mov eax, dword [esp + 0x148]
push ecx
mov ecx, dword [esp + 0x148]
push edx
mov edx, dword [esp + 0x148]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
add esp, 0x120
ret 0x30
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00a16c20
mov esi, dword [esp + 0x13c]
mov dword [esp + 0x12c], 0
test esi, esi
je 0xa220e2
mov edi, dword [esi]
lea ecx, [esp + 0x14]
push edi
call fcn.00a17310
jmp 0xa220e6
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x15c]
mov edx, dword [esp + 0x158]
push eax
mov eax, dword [esp + 0x158]
push ecx
mov ecx, dword [esp + 0x158]
push edx
mov edx, dword [esp + 0x158]
push eax
mov eax, dword [esp + 0x158]
push ecx
mov ecx, dword [esp + 0x158]
push edx
mov edx, dword [esp + 0x158]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x154]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ebp, eax
test ebp, ebp
jne 0xa22173
test esi, esi
je 0xa22173
mov ebx, dword [esp + 0x138]
test ebx, ebx
je 0xa22173
mov edx, dword [esi]
mov eax, dword [esp + 0x1c]
push edi
push ebx
push edx
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
mov dword [esi], eax
jae 0xa22173
mov word [ebx + eax*2], bp
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], 0xffffffff
call fcn.00a16c40
mov ecx, dword [esp + 0x124]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret 0x30
Function at 0xa22350
Capabilities:
Get session user name

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b77b
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x110
test al, al
push esi
je 0xa2238d
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0xa22406
mov esi, dword [esp + 0x128]
test esi, esi
jne 0xa223a2
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0xa22406
push edi
lea ecx, [esp + 8]
call fcn.00a16c20
mov edx, dword [esi]
lea ecx, [esp + 8]
push edx
mov dword [esp + 0x124], 0
call fcn.00a17310
push esi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, eax
test edi, edi
jne 0xa223ef
mov ecx, dword [esi]
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x10]
push ecx
push edx
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.00a16c40
mov eax, edi
pop edi
mov ecx, dword [esp + 0x114]
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0xa22b20
Capabilities:
Get disk size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8b82b
push eax
mov al, byte [0xaf474d]
mov dword fs:[0], esp
sub esp, 0x210
test al, al
je 0xa22b81
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
push eax
mov eax, dword [esp + 0x224]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
add esp, 0x21c
ret 0x10
mov ecx, dword [esp + 0x220]
push esi
push ecx
lea ecx, [esp + 8]
call fcn.00a152e0
mov edx, dword [esp + 0x230]
mov ecx, dword [esp + 0x22c]
push edx
mov edx, dword [esp + 0x22c]
push ecx
push edx
mov ecx, eax
mov dword [esp + 0x228], 0
call fcn.00a15680
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x21c], 0xffffffff
call fcn.00a155e0
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret 0x10