joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc5b8f9
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push edi
mov edi, ecx
test edi, edi
je 0xc5b965
push ebx
mov ebx, dword [edi]
cmp ebx, edi
je 0xc5b938
push esi
cmp dword [ebx + 0x10], 0
je 0xc5b91d
push dword [ebx + 0x10]
call dword [sym.imp.ntdll.dll_ZwClose]
and dword [ebx + 0x10], 0
mov eax, dword fs:[0x30]
mov esi, dword [ebx]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, esi
cmp esi, edi
jne 0xc5b90a
pop esi
cmp dword [edi + 0xc], 0
pop ebx
je 0xc5b953
push dword [edi + 0xc]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
ret
Function at 0xc5bb1b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
xor eax, eax
mov edi, ebx
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0xc5bb3d
add eax, 2
mov dword [ebx + 8], eax
cmp word [eax], cx
jne 0xc5bb3a
add eax, 2
mov dword [ebx + 8], eax
cmp word [eax], cx
jne 0xc5bb68
mov esi, dword [ebp + 0xc]
neg esi
sbb esi, esi
and esi, 0xfffffe47
add esi, 0xc0000273
jmp 0xc5bcc8
cmp dword [ebp + 0xc], ecx
jne 0xc5bb77
mov esi, 0xc0000103
jmp 0xc5bccc
mov cx, word [edx]
lea eax, [ebp - 4]
mov edi, dword [ebp + 0x14]
mov edx, edi
push eax
mov word [ebp - 4], cx
call fcn.00c5c115
mov esi, eax
test esi, esi
jns 0xc5bba2
push esi
push 0xa284f8
push 0xb26
jmp 0xc5bcb9
mov cx, word [ebp - 4]
lea eax, [ebp - 4]
push eax
push 4
pop edx
call fcn.00c5c115
mov esi, eax
test esi, esi
jns 0xc5bbc8
push esi
push 0xa284f8
push 0xb2c
jmp 0xc5bcb9
mov ax, word [ebp - 4]
mov word [ebx + 2], ax
xor eax, eax
mov word [ebx], ax
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x18]
movzx eax, word [ebp - 4]
push eax
push 8
push ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebx + 4], eax
test eax, eax
jne 0xc5bbfd
mov esi, 0xc0000017
jmp 0xc5bccc
mov edx, dword [ebp - 8]
mov ecx, ebx
call fcn.00c5c20d
mov esi, eax
test esi, esi
jns 0xc5bc1d
push esi
push 0xa28690
push 0xb3b
jmp 0xc5bcb9
movzx ecx, word [ebx]
mov eax, dword [ebx + 4]
shr ecx, 1
cmp word [eax + ecx*2 - 2], 0x5c
je 0xc5bc47
mov ecx, ebx
call fcn.00c5c148
mov esi, eax
test esi, esi
jns 0xc5bc47
push esi
push 0xa2861c
push 0xb4b
jmp 0xc5bcb9
mov edx, dword [ebp + 0x10]
test edx, edx
je 0xc5bc71
test di, di
je 0xc5bc71
movzx eax, di
mov ecx, ebx
push eax
call fcn.00c5c1a3
mov esi, eax
test esi, esi
jns 0xc5bc71
push esi
push 0xa28644
push 0xb53
jmp 0xc5bcb9
xor eax, eax
mov dword [ebp - 0x28], 0x18
push 0x21
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push 1
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1c], 0x40
push eax
push 0x100001
lea eax, [ebx + 0xc]
mov dword [ebp - 0x20], ebx
push eax
call dword [sym.imp.ntdll.dll_ZwOpenFile]
mov esi, eax
test esi, esi
jns 0xc5bcd3
push esi
push 0xa28534
push 0xb61
push 0xa28670
push 1
call fcn.00a32ac8
add esp, 0x14
test esi, esi
jns 0xc5bcd3
mov ecx, ebx
call fcn.00c5bd7f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0xc5c3c1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
not ecx
cmp dword [ebp + 8], esi
jbe 0xc5c3e9
movzx eax, byte [esi + edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xa28a58]
inc esi
cmp esi, dword [ebp + 8]
jb 0xc5c3d0
not ecx
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0xc5c57c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xa288d0
lea eax, [ebp - 8]
xor edi, edi
push eax
mov ebx, edx
mov dword [ebp - 8], edi
mov esi, ecx
mov dword [ebp - 4], edi
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov ecx, ebx
xor eax, eax
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0xc5c5ab
mov eax, dword [ebp - 8]
sub ecx, edx
add eax, 2
sar ecx, 1
lea edx, [eax + ecx*2]
mov eax, dword fs:[0x30]
mov word [esi + 2], dx
mov ecx, dword [eax + 0x18]
movzx eax, dx
push eax
push 8
push ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 4], eax
test eax, eax
jne 0xc5c609
movzx eax, word [esi + 2]
mov edi, 0xc0000017
push eax
push 0xa288f4
push 0x58c
push 0xa28810
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xc5c632
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
test ebx, ebx
je 0xc5c62a
cmp word [ebx], 0x5c
je 0xc5c62a
push 0x9ede5c
push esi
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
push ebx
push esi
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0xc5c639
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor eax, eax
mov ebx, edx
push esi
push edi
mov dword [ebp - 8], eax
mov edi, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlFormatCurrentUserKeyPath]
mov esi, eax
test esi, esi
jns 0xc5c67b
push esi
push 0xa2882c
push 0x5c4
push 0xa287c4
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xc5c6f3
mov ecx, ebx
xor eax, eax
mov word [edi], ax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xc5c687
mov eax, dword [ebp - 8]
sub ecx, edx
add eax, 2
sar ecx, 1
lea ecx, [eax + ecx*2]
mov eax, dword fs:[0x30]
mov word [edi + 2], cx
mov edx, dword [eax + 0x18]
movzx eax, cx
push eax
push 8
push edx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [edi + 4], eax
test eax, eax
jne 0xc5c6e0
push 0xa1db10
push 0x5d0
push 0xa287c4
push 1
mov esi, 0xc0000017
call fcn.00a32ac8
add esp, 0x10
jmp 0xc5c6f3
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
push ebx
push edi
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xc5c704
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x214], 0
push ebx
push edi
mov ebx, ecx
lea ecx, [ebp - 0x214]
push ecx
push 0x20c
lea ecx, [ebp - 0x210]
push ecx
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ntdll.dll_ZwEnumerateKey]
mov edi, eax
test edi, edi
js 0xc5c784
push esi
mov esi, dword [ebp - 0x204]
shr esi, 1
lea ecx, [esi + 1]
cmp ecx, 0x104
jb 0xc5c767
mov edi, 0xc0000023
jmp 0xc5c783
push dword [ebp - 0x204]
lea eax, [ebp - 0x200]
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebx + esi*2], ax
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 8

Function at 0xc5c8c9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x1c], 0
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0x14
lea ecx, [ebp - 0x18]
and dword [edi], 0
push ecx
push 2
push eax
push edx
call dword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov esi, eax
test esi, esi
jns 0xc5c927
cmp esi, 0xc0000034
je 0xc5c95a
push esi
push 0xa28704
push 0x3a1
push 0xa28724
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xc5c95a
cmp dword [ebp - 0x14], 4
jne 0xc5c93c
cmp dword [ebp - 0x10], 4
jne 0xc5c93c
mov eax, dword [ebp - 0xc]
xor esi, esi
mov dword [edi], eax
jmp 0xc5c95a
push 0xa286cc
push 0x3a8
push 0xa28724
push 1
call fcn.00a32ac8
add esp, 0x10
mov esi, 0xc0000024
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret 4

Function at 0xc5ca5c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x4c
pop eax
mov ebx, ecx
mov edi, edx
push 0x4e
pop ecx
push ecx
mov word [ebx], ax
mov eax, dword fs:[0x30]
push 8
mov word [ebx + 2], cx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0xc5caad
push 0xa1db10
push 0xed
push 0xa28f18
push 1
call fcn.00a32ac8
add esp, 0x10
mov edi, 0xc0000017
jmp 0xc5cb35
movzx eax, byte [edi + 0xf]
push eax
movzx eax, byte [edi + 0xe]
push eax
movzx eax, byte [edi + 0xd]
push eax
movzx eax, byte [edi + 0xc]
push eax
movzx eax, byte [edi + 0xb]
push eax
movzx eax, byte [edi + 0xa]
push eax
movzx eax, byte [edi + 9]
push eax
movzx eax, byte [edi + 8]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [edi + 4]
push eax
push dword [edi]
movzx eax, word [ebx + 2]
push 0xa28f30
shr eax, 1
push eax
push esi
call fcn.00beccef
mov edi, eax
add esp, 0x38
test edi, edi
jns 0xc5cb18
push edi
push 0xa28e9c
push 0x101
push 0xa28f18
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xc5cb1f
mov dword [ebx + 4], esi
xor esi, esi
xor edi, edi
test esi, esi
je 0xc5cb35
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0xc5fb20
Capabilities:
Enumerate pe sections

Disassembly:
mov ax, word [ecx + 0x14]
push esi
lea esi, [ecx + 0x18]
movzx eax, ax
movzx ecx, word [ecx + 6]
add esi, eax
push edi
mov edi, edx
xor edx, edx
test ecx, ecx
je 0xc5fb51
cmp edi, dword [esi + 0xc]
jb 0xc5fb49
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0xc]
cmp edi, eax
jb 0xc5fb56
add esi, 0x28
inc edx
cmp edx, ecx
jb 0xc5fb3a
xor eax, eax
pop edi
pop esi
ret
mov eax, esi
jmp 0xc5fb53

Function at 0xc5fc26
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
test edx, edx
je 0xc5fc78
mov esi, dword [edx]
test esi, esi
je 0xc5fc78
mov eax, dword [esi + 4]
xor ecx, ecx
mov dword [edi + 0xc], eax
mov byte [edi + 0x21], 1
mov eax, dword [esi + 8]
mov dword [esi + 4], ecx
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
mov word [edi + 0x22], 1
mov dword [edi + 0x34], 1
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov ecx, edx
call fcn.00c6022b
lea edx, [edi + 0x28]
lea ecx, [edi + 8]
pop edi
pop esi
jmp fcn.00a3201b
pop edi
mov eax, 0xc00000f0
pop esi
ret
Function at 0xc600c2
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
push 0x28
push 8
push dword [eax + 0x18]
mov ebx, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0xc600fb
mov esi, 0xc0000017
jmp 0xc60224
push dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x24], 0x18
push 0x8000000
push 2
push ecx
mov dword [ebp - 0x20], ecx
lea eax, [edi + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x24]
push ecx
push 0xf0005
push eax
call dword [sym.imp.ntdll.dll_ZwCreateSection]
mov esi, eax
test esi, esi
jns 0xc60155
push esi
push 0xa28924
push 0x159
push 0xa29ee0
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xc60218
mov ecx, dword [ebx + 8]
lea edx, [edi + 0x20]
mov eax, dword [ebx + 0xc]
sub ecx, 0x1000
push 2
push 0x500000
sbb eax, 0
and ecx, 0xffff0000
push 2
mov dword [edx], ecx
mov dword [edx + 4], eax
lea eax, [edi + 0x1c]
push eax
push edx
push 0
push 0
lea eax, [edi + 0x18]
push eax
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.ntdll.dll_ZwMapViewOfSection]
mov esi, eax
test esi, esi
jns 0xc601a6
push esi
push 0xa29f90
push 0x175
jmp 0xc60141
mov ebx, 0x20000000
lea ecx, [edi + 0xc]
lea eax, [edi + 0x10]
lea edx, [edi + 8]
push 2
push 0x500000
push 2
push ecx
push eax
xor esi, esi
mov dword [ecx], ebx
push esi
push esi
push edx
mov dword [eax], esi
push 0xffffffffffffffff
mov dword [eax + 4], esi
push dword [edi + 4]
call dword [sym.imp.ntdll.dll_ZwMapViewOfSection]
mov esi, eax
shr ebx, 1
cmp esi, 0xc0000017
jne 0xc601f3
lea eax, [edi + 0x10]
lea ecx, [edi + 0xc]
lea edx, [edi + 8]
cmp ebx, 0x100000
jae 0xc601b4
mov ebx, dword [ebp - 8]
test esi, esi
jns 0xc6020a
push esi
push 0xa29fcc
push 0x19f
jmp 0xc60141
mov eax, dword [ebp - 0xc]
mov dword [edi], ebx
mov dword [eax], edi
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
test edi, edi
je 0xc60224
lea ecx, [ebp - 4]
call fcn.00c6022b
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xc640b9
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x418]
push esi
push eax
mov ebx, edx
mov edi, ecx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
jne 0xc64101
push 0xa2a184
push 0xe
pop edx
mov ecx, dword [ebp + 4]
call fcn.00b5af13
jmp 0xc64258
push 0xa2a12c
lea eax, [ebp - 0x418]
push eax
push esi
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
mov esi, eax
test esi, esi
jns 0xc64139
push esi
push 0xa2a184
push 0x10
mov ecx, dword [ebp + 4]
pop edx
call fcn.00aa4c55
mov eax, esi
jmp 0xc64258
lea ecx, [ebp - 0x210]
mov esi, 0xa2a15c
mov eax, ecx
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0xc6416b
movzx eax, word [esi + ecx]
test ax, ax
je 0xc6416b
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0xc6414d
test edx, edx
jne 0xc64172
sub ecx, 2
xor eax, eax
mov esi, edx
neg esi
mov word [ecx], ax
sbb esi, esi
and esi, 0x7ff8ff86
add esi, 0x8007007a
test edx, edx
jne 0xc64197
push esi
push 0xa2a184
push 0x12
jmp 0xc64129
xor esi, esi
mov ecx, dword [esi + 0x9ea0c8]
mov eax, ecx
and eax, edi
cmp eax, ecx
jne 0xc641f5
push 0xa14f0c
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.00a4355b
test eax, eax
jns 0xc641ca
push eax
push 0xa2a184
push 0x18
jmp 0xc641ec
push dword [esi + 0x9ea0cc]
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.00a4355b
test eax, eax
jns 0xc641f5
push eax
push 0xa2a184
push 0x1a
mov ecx, dword [ebp + 4]
pop edx
call fcn.00ab606d
add esi, 8
cmp esi, 0x28
jb 0xc64199
push 0x40
xor esi, esi
mov dword [ebp - 0x668], 0x44
lea eax, [ebp - 0x664]
push esi
push eax
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x668]
push 0x20
pop edi
push ebx
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x63c], edi
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0xc64256
push 0xa2a184
mov edx, edi
jmp 0xc640f4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret

Function at 0xc642a5
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0xc642d9
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
test eax, eax
je 0xc642d9
cmp dword [ebp - 4], 0x103
jne 0xc642d9
push 0
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
pop esi
leave
ret
Function at 0xc78bab
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
push 2
push 0xa2a3cc
push 0x9f6c20
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jle 0xc78c01
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xc78c1f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc78c0c
sub ecx, edx
sar ecx, 1
je 0xc78c1f
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret

Function at 0xc78ca3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x214], 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push 2
push 0xa2a4d0
push 0xa2a608
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xc78d2a
cmp dword [ebp - 0x214], ebx
je 0xc78d2a
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc78d15
sub ecx, edx
sar ecx, 1
je 0xc78d2a
mov bl, 1
jmp 0xc78d63
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
push eax
push 0xa2a490
push 0xa2a4f8
call dword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_0.dll_PolicyManager_GetPolicyString]
test eax, eax
js 0xc78d63
mov eax, dword [ebp - 0x210]
test eax, eax
je 0xc78d5c
cmp word [eax], bx
je 0xc78d5c
mov bl, 1
push eax
call dword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_0.dll_PolicyManager_FreeStringValue]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
Function at 0xc7a905
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0xb07836
call fcn.00af8df7
mov ebx, edx
mov edi, ecx
xor esi, esi
lea ecx, [ebp - 0x30]
mov dword [ebx], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call fcn.00a4539d
or dword [ebp - 0x2c], 0xffffffff
lea edx, [ebp - 0x30]
or dword [ebp - 0x28], 0xffffffff
mov ecx, edi
push esi
call fcn.00a9b16a
mov esi, eax
test esi, esi
js 0xc7aa2e
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x18]
and dword [ebp - 0x18], 0
call fcn.00c7aa3e
mov esi, eax
test esi, esi
js 0xc7aa2e
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00c7aa72
mov esi, eax
test esi, esi
js 0xc7aa08
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
mov edi, 0x80070000
test esi, esi
jle 0xc7a9a6
movzx esi, si
or esi, edi
test esi, esi
js 0xc7a9ee
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0xa2b3dc
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0xc7a9d8
movzx esi, si
or esi, edi
test esi, esi
js 0xc7a9ee
cmp dword [ebp - 0x20], 4
jne 0xc7a9e9
mov eax, dword [ebp - 0x24]
xor esi, esi
mov dword [ebx], eax
jmp 0xc7a9ee
mov esi, 0x80004005
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
test eax, eax
je 0xc7aa04
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_appmodel_state_l1_2_0.dll_CloseState]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x14], 0
test eax, eax
je 0xc7aa2a
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00a4539d
mov eax, esi
call fcn.00af8dc0
ret

Function at 0xc7af85
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xc7afaf
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xc7afa7
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xc7afc2
mov eax, 0x80004005
ret
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x7fff0001
add eax, 0x8000ffff
ret
Function at 0xc7c36f
Capabilities:
Set registry value

Disassembly:
push 0x21c
mov eax, 0xb0793a
call fcn.00af8e2b
push 0x9f6410
push 0xa2d4e8
push 0x9f3a24
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00a60c0c
mov esi, eax
add esp, 0x14
test esi, esi
jns 0xc7c3bf
mov ecx, dword [ebp + 4]
mov edx, 0x18d
push esi
push 0xa2d47c
call fcn.00aa4c55
jmp 0xc7c4e8
xor edi, edi
lea eax, [ebp - 0x21c]
push edi
push eax
push edi
push 2
push edi
push edi
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], edi
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0xc7c3f5
mov edx, 0x199
jmp 0xc7c4b6
mov ecx, dword [ebp - 0x21c]
xor edx, edx
push 0x9f63b8
push 0xa2d57c
call fcn.00b87171
mov esi, eax
test esi, esi
jns 0xc7c42a
mov ecx, dword [ebp + 4]
mov edx, 0x19e
push esi
push 0xa2d47c
call fcn.00aa4c55
jmp 0xc7c4ca
mov eax, dword [ebp + 8]
push 4
pop esi
push esi
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
push esi
push 0xa2d4a8
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
je 0xc7c45c
mov edx, 0x1a7
jmp 0xc7c4b6
push esi
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x10000000
push eax
push esi
push 0xa2d4c4
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
je 0xc7c48c
mov edx, 0x1b0
jmp 0xc7c4b6
push esi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], edi
push eax
push esi
push 0xa2d458
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
je 0xc7c4c8
mov edx, 0x1bc
mov ecx, dword [ebp + 4]
push eax
push 0xa2d47c
call fcn.00b667e8
mov esi, eax
jmp 0xc7c4ca
mov esi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x21c], edi
test eax, eax
je 0xc7c4e4
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00af8dd5
ret 8

Function at 0xc7c4f2
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x9f6410
push 0xa2d4e8
push 0x9f3a24
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00a60c0c
mov esi, eax
add esp, 0x14
test esi, esi
jns 0xc7c548
mov edx, 0x179
mov ecx, dword [ebp + 4]
push esi
push 0xa2d47c
call fcn.00aa4c55
mov eax, esi
jmp 0xc7c57a
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
mov esi, eax
test esi, esi
jle 0xc7c56f
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xc7c578
mov edx, 0x17a
jmp 0xc7c536
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret