joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcb1734
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
lea eax, [ebp - 0x2c]
push esi
push eax
push esi
push 6
push esi
push esi
push esi
push 0xb47420
push reloc.SHCORE.dll_Ordinal_1
mov dword [ebp - 0x2c], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0xcb17bf
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0x34]
push eax
push 3
push 0xb47408
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
jne 0xcb17bf
cmp dword [0xd082a0], 5
jbe 0xcb17bf
push 0x2000
push esi
mov ecx, 0xd082a0
call fcn.00b54cc0
test al, al
je 0xcb17bf
lea eax, [ebp - 0x28]
mov edx, 0xb39f94
push eax
push 2
push esi
push esi
call fcn.00b809fe
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
test eax, eax
je 0xcb17d0
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
Function at 0xcbf94d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x14
cmp byte [eax], 0
je 0xcbfa8f
push edi
mov edi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0xcbfa8e
push ebx
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push 0xb30a58
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jle 0xcbf99d
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xcbfa4e
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 1
push 0xb311a4
call dword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0xcbfa11
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0xcbf9e9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push 0xf003f
push ebx
push ebx
push ebx
push 0xb30a58
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
jmp 0xcbfa17
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xcbfa26
movzx esi, si
or esi, 0x80070000
cmp dword [ebp - 8], 0
je 0xcbfa35
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test esi, esi
jns 0xcbfa4e
mov ecx, dword [ebp + 4]
mov edx, 0x3de
push esi
push 0xb30ac4
call fcn.00b913f8
jmp 0xcbfa7b
push 0xf
push dword [ebp + 8]
push 3
push ebx
push 0xb30b1c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0xcbfa7b
mov ecx, dword [ebp + 4]
mov edx, 0x3e1
push eax
push 0xb30ac4
call fcn.00cd3b6e
cmp dword [ebp - 4], 0
pop esi
mov byte [edi], bl
pop ebx
je 0xcbfa8e
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov esp, ebp
pop ebp
ret 0x14
Function at 0xcbfa95
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x14
cmp byte [eax], 0
je 0xcbfbd7
push edi
mov edi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0xcbfbd6
push ebx
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push 0xb30a58
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jle 0xcbfae5
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xcbfb96
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 1
push 0xb311a4
call dword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0xcbfb59
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0xcbfb31
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push 0xf003f
push ebx
push ebx
push ebx
push 0xb30a58
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
jmp 0xcbfb5f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xcbfb6e
movzx esi, si
or esi, 0x80070000
cmp dword [ebp - 8], 0
je 0xcbfb7d
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test esi, esi
jns 0xcbfb96
mov ecx, dword [ebp + 4]
mov edx, 0x3de
push esi
push 0xb30ac4
call fcn.00b913f8
jmp 0xcbfbc3
push 0xc
push dword [ebp + 8]
push 3
push ebx
push 0xb30af8
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0xcbfbc3
mov ecx, dword [ebp + 4]
mov edx, 0x3e1
push eax
push 0xb30ac4
call fcn.00cd3b6e
cmp dword [ebp - 4], 0
pop esi
mov byte [edi], bl
pop ebx
je 0xcbfbd6
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov esp, ebp
pop ebp
ret 0x14
Function at 0xcbfbdd
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x14
cmp byte [eax], 0
je 0xcbfd22
push edi
mov edi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0xcbfd21
push ebx
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push 0xb30a58
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jle 0xcbfc2d
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xcbfcde
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 1
push 0xb311a4
call dword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0xcbfca1
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0xcbfc79
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push 0xf003f
push ebx
push ebx
push ebx
push 0xb30a58
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
jmp 0xcbfca7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xcbfcb6
movzx esi, si
or esi, 0x80070000
cmp dword [ebp - 8], 0
je 0xcbfcc5
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test esi, esi
jns 0xcbfcde
mov ecx, dword [ebp + 4]
mov edx, 0x3de
push esi
push 0xb30ac4
call fcn.00b913f8
jmp 0xcbfd0e
push 0xa0
push dword [ebp + 8]
push 3
push ebx
push 0xb30b2c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0xcbfd0e
mov ecx, dword [ebp + 4]
mov edx, 0x3e1
push eax
push 0xb30ac4
call fcn.00cd3b6e
cmp dword [ebp - 4], 0
pop esi
mov byte [edi], bl
pop ebx
je 0xcbfd21
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov esp, ebp
pop ebp
ret 0x14
Function at 0xcc2a6b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
mov ebx, 0xb444c0
push eax
push 0
push 0x10
push ebx
mov edi, ecx
push 0xb44500
push reloc.OLEAUT32.dll_SysReAllocString
and dword [edi], 0
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jle 0xcc2ab5
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xcc2adf
cmp esi, 0x80070002
je 0xcc2ae4
push ebx
push 0xb44500
push 0xb45318
push esi
push 0xb30450
push 0x4f
push dword [ebp + 4]
call fcn.00caa094
add esp, 0x1c
jmp 0xcc2ae6
mov eax, dword [ebp - 8]
mov dword [edi], eax
xor esi, esi
test esi, esi
jns 0xcc2afd
mov ecx, dword [ebp + 4]
mov edx, 0x1aa
push esi
push 0xb4804c
call fcn.00bc28ed
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xcc2b99
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xc8
lea eax, [ebp - 0xcc]
mov esi, ecx
push 0
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0xd0], 0x64
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xc
call dword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
je 0xcc2c15
lea eax, [ebp - 0xcc]
push 0xb3d3b8
push eax
call dword [sym.imp.msvcrt.dll_wcscspn]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0x64
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x18
mov al, 1
jmp 0xcc2c17
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret

Function at 0xcc2c9f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
mov edi, 0x80
xor ebx, ebx
push edi
push ebx
push eax
mov dword [esi], ebx
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x88], edi
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push ebx
push 0x20000002
push 0xb484c0
push 0xb485a8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
lea ecx, [ebp - 0x84]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xcc2d0c
sub ecx, edx
lea eax, [ebp - 0x84]
push esi
sar ecx, 1
push ecx
push ecx
push eax
call fcn.00b55f90
mov esi, eax
test esi, esi
jns 0xcc2d47
mov ecx, dword [ebp + 4]
mov edx, 0x40d
push esi
push 0xb30ac4
call fcn.00bc2921
mov eax, esi
jmp 0xcc2d49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
Function at 0xccd8f3
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 8], 0
je 0xccda57
mov eax, dword [edi]
push dword [eax]
push 0xb48040
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0xccda57
push 2
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [edi + 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
test eax, eax
je 0xccda57
push ebx
push esi
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x20]
push 2
pop ebx
push 1
push 4
push eax
push dword [edi + 8]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
test eax, eax
je 0xccd968
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ebx
mov eax, dword [edi]
push dword [eax]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
mov dword [ebp - 0x14], eax
mov ecx, 0xffff
add eax, 8
add esi, eax
cmp eax, ecx
ja 0xccda55
cmp esi, ecx
ja 0xccda55
lea ecx, [ebp - 0x1c]
add eax, esi
push ecx
push eax
call fcn.00b84a5c
test eax, eax
js 0xccda55
push ebx
mov ebx, dword [ebp - 0x1c]
push esi
push ebx
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeAcl]
mov ecx, dword [ebp - 0x14]
add esi, ebx
push ecx
lea eax, [ecx + 8]
mov byte [esi], 1
mov word [esi + 2], ax
mov dword [esi + 4], 2
mov eax, dword [edi]
push dword [eax]
lea eax, [esi + 8]
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0x14]
add esp, 0xc
add eax, 8
push eax
push esi
push 0xffffffffffffffff
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAce]
test eax, eax
je 0xccda4e
and dword [ebp - 0x14], 0
xor esi, esi
cmp dword [ebp - 0x10], esi
jbe 0xccda37
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [edi + 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
je 0xccda2a
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAce]
test eax, eax
jne 0xccda2a
inc eax
mov dword [ebp - 0x14], eax
jmp 0xccda2d
mov eax, dword [ebp - 0x14]
inc esi
cmp esi, dword [ebp - 0x10]
jb 0xccd9f9
test eax, eax
jne 0xccda4e
push 0
push ebx
push 0
push 0
push 0x20000004
push 4
push dword [edi + 4]
call dword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetSecurityInfo]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
Function at 0xccf86d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
push 0
push 8
push dword [ebp + 0x18]
push 0xb30a58
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xccf8b7
cmp dword [ebp - 4], 4
jbe 0xccf8b7
cmp byte [esi], 6
je 0xccf8bd
and dword [esi], 0
mov byte [esi], 6
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0xccfc1a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0xbd0714
call fcn.00bc1397
mov edx, dword [ebp + 0x10]
xor esi, esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0xccfc7b
call fcn.00cc1c21
mov esi, eax
jmp 0xccfd93
push esi
push ebx
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
jne 0xccfc9a
call fcn.00cc1c21
jmp 0xccfd8a
push ebx
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0xccfc90
push ebx
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
lea ecx, [ebx + 1]
cmp ecx, ebx
jae 0xccfce6
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0xccfcdc
lea ecx, [ebp - 0x418]
call fcn.00cc2984
mov esi, 0x8007000e
jmp 0xccfdac
push 2
pop edx
mov byte [ebp - 4], 2
call fcn.00cbda99
cmp eax, 0x400
jbe 0xccfd0d
push eax
lea ecx, [ebp - 0x418]
call fcn.00cc1854
mov eax, dword [ebp - 0x418]
jmp 0xccfd19
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0xccfd43
test eax, eax
jne 0xccfd4e
mov esi, 0x8007000e
jmp 0xccfd8c
push ebx
push eax
push ebx
push dword [ebp - 0x424]
push esi
push 3
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0xccfc90
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.00ccf98e
mov esi, eax
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0xccfdac
lea ecx, [ebp - 0x418]
call fcn.00cc2984
lea ecx, [ebp - 0x428]
call fcn.00cc0581
mov eax, esi
call fcn.00bc12e9
ret 0x10
Function at 0xcd1172
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0xbd07d2
call fcn.00bc12f8
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], esi
push eax
push ecx
call fcn.00bbb6fa
test eax, eax
jns 0xcd11a4
push 8
pop esi
jmp 0xcd11ea
push esi
lea eax, [ebp - 0x18]
mov ebx, 0xb481f8
push eax
push esi
push 0x60000
push esi
push esi
push esi
push ebx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0xcd11ea
lea ecx, [ebp - 0x1c]
call fcn.00cd2f5e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00ccd8f3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0xcd11fd
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, esi
call fcn.00bc12c6
ret 0x10

Function at 0xcd1488
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
test edx, edx
jne 0xcd14a5
mov ecx, 0x80004005
call fcn.00cc1c44
xor eax, eax
mov edi, edx
mov dword [ebp - 4], eax
mov esi, eax
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0xcd14b6
sub ecx, dword [ebp - 8]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0xcd14ae
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xcd1529
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
jne 0xcd1544
mov ecx, 0x80004005
call fcn.00cc1c44
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xcd154b
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0xcd2d55
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [ecx + 0x20]
movzx eax, byte [ecx + 0x1a]
push eax
movzx eax, byte [ecx + 0x15]
push eax
movzx eax, byte [ecx + 0x14]
push eax
push dword [ecx + 0x94]
movzx eax, byte [ecx + 0x19]
push dword [ecx + 0x90]
mov edi, dword [ebp + 8]
push eax
push dword [ecx + 0x8c]
movzx eax, byte [ecx + 0x11]
push dword [ecx + 0x88]
push eax
push dword [ecx + 0x84]
movzx eax, byte [ecx + 0x10]
push dword [ecx + 0x80]
push eax
push dword [ecx + 0x7c]
movzx eax, byte [ecx + 0xf]
push dword [ecx + 0x78]
push eax
push dword [ecx + 0x74]
movzx eax, byte [ecx + 0xe]
push dword [ecx + 0x70]
push eax
push dword [ecx + 0x28]
movzx eax, byte [ecx + 0x17]
push eax
push dword [ecx + 0x24]
movzx eax, byte [ecx + 0x16]
push eax
push dword [ecx + 0x98]
movzx eax, byte [ecx + 0x18]
push eax
push dword [ecx + 0x6c]
movzx eax, byte [ecx + 0xd]
push eax
push dword [ecx + 0x64]
movzx eax, byte [ecx + 0x13]
push eax
push dword [ecx + 0x68]
movzx eax, byte [ecx + 0x12]
push eax
push dword [ecx + 0x60]
movzx eax, byte [ecx + 0xc]
push dword [ecx + 0x5c]
push eax
push dword [ecx + 0x58]
movzx eax, byte [ecx + 0xb]
push dword [ecx + 0x54]
push eax
push dword [ecx + 0x50]
movzx eax, byte [ecx + 0xa]
push dword [ecx + 0x4c]
push eax
push dword [ecx + 0x3c]
movzx eax, byte [ecx + 9]
push dword [ecx + 0x38]
push eax
push dword [ecx + 0x34]
movzx eax, byte [ecx + 8]
push dword [ecx + 0x30]
push eax
push dword [ecx + 0x48]
movzx eax, byte [ecx + 7]
push eax
movzx eax, byte [ecx + 6]
push eax
push dword [ecx + 0x44]
movzx eax, byte [ecx + 5]
push eax
movzx eax, byte [ecx + 4]
push eax
push dword [ecx + 0x40]
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
push dword [ecx + 0x1c]
movzx eax, byte [ecx + 1]
push eax
push dword [ecx + 0x2c]
movzx eax, byte [ecx]
push eax
push 0xb482e0
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.00b55e8f
mov esi, eax
add esp, 0xf8
test esi, esi
jns 0xcd2ea3
mov edx, 0x111
mov ecx, dword [ebp + 4]
push esi
push 0xb30ac4
call fcn.00bc2921
mov eax, esi
jmp 0xcd2ed9
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcd2eac
sub ecx, edx
lea eax, [ebp - 0x404]
push edi
sar ecx, 1
push ecx
push ecx
push eax
call fcn.00b55f90
mov esi, eax
test esi, esi
jns 0xcd2ed7
mov edx, 0x112
jmp 0xcd2e91
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
Function at 0xcd421c
Capabilities:
Delete file

Disassembly:
push 0x34
mov eax, 0xbd08f7
call fcn.00bc132b
push 0x60
push 0xb46ee8
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0xb4880c
mov dword [ebp - 0x2c], 0xb487d4
call fcn.00cc042b
and dword [ebp - 4], 0
and dword [ebp - 0x20], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00b8ba6f
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
call fcn.00ccdca4
test al, al
je 0xcd4377
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
push eax
push 0x10000
push esi
mov edi, dword [esi]
mov ecx, dword [edi + 0x18]
call dword [0xd0cffc]
call dword [edi + 0x18]
test eax, eax
js 0xcd4251
test dword [ebp - 0x24], 0x10000
je 0xcd4251
and dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
mov edi, dword [esi]
push eax
push 0xb2d884
push esi
mov ecx, dword [edi + 0x48]
call dword [0xd0cffc]
call dword [edi + 0x48]
test eax, eax
js 0xcd435b
cmp dword [ebp - 0x28], 1
jne 0xcd435b
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0xcd42e4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov edi, eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
push edi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
mov edi, dword [esi]
push eax
push 0xb2a618
push esi
mov ecx, dword [edi + 0x44]
call dword [0xd0cffc]
call dword [edi + 0x44]
test eax, eax
js 0xcd435b
lea ebx, [ebp - 0x30]
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x18]
call fcn.00b51d2e
test eax, eax
je 0xcd4351
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
and dword [ebp - 0x1c], 0
mov edi, dword [esi]
push eax
push 0x80058000
push esi
mov ecx, dword [edi + 0x14]
call dword [0xd0cffc]
call dword [edi + 0x14]
test eax, eax
js 0xcd4342
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
cmp dword [ebp - 0x1c], 0
je 0xcd4351
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
add ebx, 4
lea eax, [ebp - 0x28]
cmp ebx, eax
jne 0xcd4307
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0
je 0xcd4251
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xcd4251
lea ecx, [ebp - 0x20]
call fcn.00b8ba6f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x38]
and dword [ebp - 0x38], 0
test ecx, ecx
je 0xcd439e
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00bbfcd3
call fcn.00bc12da
ret