joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa8c51e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1224
call fcn.00af9320
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x1211]
push ebx
push esi
push edi
push edx
xor ebx, ebx
mov dword [ebp - 0x1220], ecx
mov edx, eax
mov dword [ebp - 0x1224], eax
mov byte [ebp - 0x1211], bl
call fcn.00a8c5de
mov esi, eax
test esi, esi
js 0xb387ea
cmp byte [ebp - 0x1211], bl
jne 0xa8c5cb
lea eax, [ebp - 0x121c]
mov dword [ebp - 0x1218], ebx
push eax
lea eax, [ebp - 0x1218]
mov dword [ebp - 0x121c], 4
push eax
push ebx
push 0x10
push 0x9f0f78
mov esi, 0x9f0f00
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, 0xa1514c
test eax, eax
je 0xb38826
mov esi, ebx
test esi, esi
js 0xb38810
mov ecx, dword [ebp - 0x1224]
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 8
push esi
push 0xa1514c
mov edx, 0x171
jmp 0xb38817
mov ecx, dword [ebp + 4]
mov esi, 0x80070057
push esi
mov edi, 0xa1514c
mov edx, 0x163
push edi
call fcn.00aa4c55
push esi
push edi
mov edx, 0x179
mov ecx, dword [ebp + 4]
call fcn.00aa4c55
mov eax, esi
jmp 0xa8c5cd
push dword [ebp - 0x1220]
lea eax, [ebp - 0x1210]
push dword [ebp - 0x1218]
push esi
push 0xa1512c
push 0x800
push eax
call fcn.00a60c0c
mov esi, eax
add esp, 0x18
test esi, esi
jns 0xb3886d
mov edx, 0x13d
jmp 0xb3885e
mov edx, 0x15c
mov ecx, dword [ebp + 4]
push esi
push edi
call fcn.00aa4c55
jmp 0xa8c5b7
mov esi, dword [ebp - 0x1224]
cmp dword [esi], ebx
jl 0xb387f7
cmp dword [esi], 1
jle 0xb38909
cmp dword [esi], 2
jne 0xb387f7
push 0x208
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x1220], 0x208
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push 2
push 0xa15140
lea eax, [ebp - 0x1210]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb38950
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb388dd
sub ecx, edx
lea eax, [esi + 8]
push eax
sar ecx, 1
lea eax, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateString]
mov esi, eax
test esi, esi
jns 0xb3894e
jmp 0xb38859
lea eax, [ebp - 0x121c]
mov dword [ebp - 0x1218], ebx
push eax
lea eax, [ebp - 0x1218]
mov dword [ebp - 0x121c], 4
push eax
push ebx
push 0x10
push 0xa15140
lea eax, [ebp - 0x1210]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb38950
mov eax, dword [ebp - 0x1218]
mov dword [esi + 4], eax
mov bl, 1
test bl, bl
je 0xa8c5bf
jmp 0xa8c5cb
Function at 0xa8c5de
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
xor ecx, ecx
mov byte [edi], cl
cmp dword [esi], ecx
jl 0xb389a7
cmp dword [esi], 1
jg 0xa8c65b
lea eax, [ebp - 0x220]
mov dword [ebp - 0x218], ecx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 4
push eax
push ecx
push 0x10
push ebx
push 0x9f0f88
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0xb38996
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 4
cmp dword [esi], 2
jne 0xb389a7
push 0x208
push ecx
lea eax, [ebp - 0x214]
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
xor eax, eax
push eax
push 2
push ebx
push 0x9f0f88
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xa8c648
jmp 0xb3895d
lea ecx, [ebp - 0x214]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb38968
sub ecx, edx
lea eax, [esi + 8]
push eax
sar ecx, 1
lea eax, [ebp - 0x214]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateString]
mov esi, eax
test esi, esi
jns 0xb3899f
mov edx, 0x123
jmp 0xb389b1
mov eax, dword [ebp - 0x218]
mov dword [esi + 4], eax
mov byte [edi], 1
jmp 0xa8c648
mov esi, 0x80070057
mov edx, 0x12a
mov ecx, dword [ebp + 4]
push esi
push 0xa1514c
call fcn.00aa4c55
mov eax, esi
jmp 0xa8c64a

Function at 0xa8c703
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push 0x10
push 0x9f1034
push 0x9f0528
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0xb389c6
xor eax, eax
leave
ret
mov eax, dword [ebp - 4]
cmp eax, 2
jbe 0xa8c740
jmp 0xa8c73e

Function at 0xa8c802
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push 0x10
push 0x9f10bc
push 0x9f1058
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp eax, 2
jne 0xb38a1f
mov al, 1
leave
ret
test eax, eax
je 0xb38a39
mov ecx, dword [ebp + 4]
push eax
push 0xa14744
push 0x50
pop edx
call fcn.00b5b6e5
jmp 0xa8c841
cmp dword [ebp - 4], 1
sete al
leave
ret
Function at 0xa8d4c6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
xor edi, edi
cmp dword [ebx + 0xb0], edi
ja 0xa8d658
lea eax, [ebp - 0x41c]
push eax
push 9
push edi
push 0x9f12d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jg 0xb390ab
js 0xa8d647
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x428]
push eax
push edi
push edi
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jg 0xb390bb
js 0xa8d63b
cmp dword [ebp - 0x428], edi
jbe 0xa8d63b
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x104
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHEnumKeyExW]
mov esi, eax
test esi, esi
jg 0xb390cb
js 0xa8d62e
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x104
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x434]
push eax
push 2
push 0x9f12ac
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jg 0xb390db
js 0xa8d62e
and dword [ebp - 0x424], 0
lea eax, [ebp - 0x424]
and dword [ebp - 0x420], 0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_SHStrDupW]
test eax, eax
js 0xb390eb
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_SHStrDupW]
test eax, eax
js 0xb390eb
push ecx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebx + 0xac]
call fcn.00ab0683
mov esi, eax
test esi, esi
js 0xb390eb
inc edi
cmp edi, dword [ebp - 0x428]
jb 0xa8d551
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
xor eax, eax
jmp 0xa8d649
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xa8d512
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xa8d53f
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xa8d580
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xa8d5c9
push dword [ebp - 0x424]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
push dword [ebp - 0x420]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xa8d62e
Function at 0xa8d943
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 8]
xor eax, eax
push esi
push edi
test bl, bl
mov dword [ebp - 0x1c], ecx
mov esi, 0xa03690
mov dword [ebp - 0x28], 4
setne al
mov dword [ebp - 0x24], 0x14
mov dword [ebp - 0x18], eax
lea edi, [ebp - 0x14]
lea eax, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x9f1514
push esi
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowExW]
test eax, eax
je 0xa8d9aa
lea ecx, [ebp - 0x28]
push ecx
push esi
push 0x4a
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
test bl, bl
jne 0xb39264
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 4
mov ecx, dword [ebp - 0x1c]
call fcn.00a8fd2c
jmp 0xa8d9b2

Function at 0xa8e175
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
call fcn.00a8f2bb
push 0x9f1630
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_RegisterWindowMessageW]
push 0x9f15f8
mov dword [esi + 0x17c], eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_RegisterWindowMessageW]
mov edx, dword [esi + 0x220]
mov dword [esi + 0x180], eax
push edx
mov eax, dword [edx]
mov edi, dword [eax + 0x2c]
cmp edi, fcn.00a8f240
jne 0xb394f7
call fcn.00a8f240
xor edi, edi
push edi
push edi
push 0x9f15c0
push 0x9f02f0
call dword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
test eax, eax
setne al
mov byte [esi + 0x12c], al
call fcn.00aa56cf
push esi
push dword [0xc9596c]
neg eax
push edi
push edi
push edi
push edi
push edi
push edi
push 0x82000000
sbb eax, eax
push edi
and eax, 0x400000
add eax, 0x180
push 0x9f1514
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_CreateWindowExW]
pop edi
pop esi
jmp fcn.00a8f2aa
mov ecx, edi
call dword [0xc99200]
call edi
jmp 0xa8e1bf
Function at 0xa8e870
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], 2
lea edi, [ebp - 0x14]
mov esi, 0xa03668
mov dword [ebp - 0x24], 4
xor ebx, ebx
mov dword [ebp - 0x20], 0x14
push ebx
lea eax, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push 0x9f1514
mov dword [ebp - 0x1c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
test eax, eax
je 0xa8e8d0
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0x4a
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
and al, 1
mov bl, al
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret

Function at 0xa8ea73
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0x9f1514
mov edi, edx
mov ebx, ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
mov esi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0xa8eaba
js 0xa8ea9f
mov eax, 0x80004005
test esi, esi
je 0xb39ba2
push dword [ebp + 8]
push edi
push ebx
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_PostMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 4
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xa8ea98
mov ecx, dword [ebp + 4]
mov edx, 0x40e
push eax
push 0x9f6984
call fcn.00ab606d
jmp 0xa8eab3

Function at 0xa8f2aa
Capabilities:
Create thread

Disassembly:
push 0x56
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
jne 0xb39d3e
ret
xor ecx, ecx
mov edx, 0xc971e0
inc ecx
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xa8f2ba
push eax
push 8
push eax
push 0xb61340
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
ret

Function at 0xa90a0d
Capabilities:
Shutdown system

Disassembly:
push 8
mov eax, 0xafe5da
call fcn.00af8df7
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
and dword [ebp - 0x10], 0
push eax
call fcn.00a8ec51
mov esi, eax
test esi, esi
js 0xb3a70f
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x18]
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
js 0xb3a716
cmp dword [ebp - 0x14], 1
je 0xb3a754
xor esi, esi
lea ecx, [ebp - 0x10]
call fcn.00a7c3fb
mov eax, esi
call fcn.00af8dc0
ret
mov edx, 0x84
jmp 0xb3a768
mov ecx, esi
call fcn.00c52d4d
mov ecx, dword [0xc93264]
cmp ecx, 0xc93264
je 0xb3a745
test byte [ecx + 0x1c], 2
je 0xb3a745
push esi
push dword [ecx + 0x14]
mov edx, 0xa27598
push dword [ecx + 0x10]
push 0xa
pop ecx
call fcn.00b7b7a6
push 0
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0xa90a5f
call fcn.00c52c54
mov esi, eax
test esi, esi
jns 0xa90a5f
mov edx, 0x92
mov ecx, dword [ebp + 4]
push esi
push 0x9ff394
call fcn.00aa4c55
jmp 0xa90a61
Function at 0xa92517
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0xafe8cc
call fcn.00af8df7
mov dword [ebp - 0x1c], ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push ecx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov edx, 0x9f05b0
push 0x9f2110
mov ecx, edi
call fcn.00a41860
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push ecx
push 0x9f20f4
mov edx, 0x9f2070
mov ecx, edi
call fcn.00a41860
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x10], 0
jne 0xb3b0b4
push ecx
push ecx
push ebx
mov ecx, 0xc97b10
call fcn.00a929b4
cmp dword [ebp - 0x14], 0
jne 0xa925b9
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x20010010
push 0x9f1ee0
push 0x9f1e60
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp dword [ebp - 0x18], 0
jne 0xa925b9
mov eax, dword [0xc959c4]
test eax, eax
jne 0xb3b0cc
xor bl, bl
mov al, bl
call fcn.00af8dc0
ret
push 0
push 0x9f20f4
mov edx, 0x9f2070
mov ecx, edi
call fcn.00b61f25
jmp 0xa92579
cmp eax, ebx
jne 0xa925b9
mov eax, dword [ebp - 0x1c]
test al, 2
jne 0xb3b0e5
cmp dword [ebp - 0x10], 0
je 0xa925b9
test eax, 0x2011
je 0xa925bb
jmp 0xa925b9
Function at 0xa92827
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push esi
push eax
push 0x20019
xor ebx, ebx
mov esi, ecx
push ebx
push 0x9f1fc0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xa929b0
push edi
push 4
pop edi
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x9f1f9c
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xa92894
cmp dword [ebp - 8], edi
jne 0xa92894
cmp dword [ebp - 4], edi
jne 0xa92894
mov eax, dword [ebp - 0xc]
cmp eax, 0x3e8
jb 0xa92894
mov dword [esi + 0x18], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x9f1f78
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xa928cb
cmp dword [ebp - 8], edi
jne 0xa928cb
cmp dword [ebp - 4], edi
jne 0xa928cb
mov eax, dword [ebp - 0xc]
cmp eax, 0x64
jb 0xa928cb
mov dword [esi + 0xc], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x9f1f60
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xa92902
cmp dword [ebp - 8], edi
jne 0xa92902
cmp dword [ebp - 4], edi
jne 0xa92902
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0xc]
jbe 0xa92902
mov dword [esi + 0x10], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x9f1f34
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xa92939
cmp dword [ebp - 8], edi
jne 0xa92939
cmp dword [ebp - 4], edi
jne 0xa92939
mov eax, dword [ebp - 0xc]
cmp eax, 0x32
jae 0xa92939
mov dword [esi + 8], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x9f1f0c
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xa9296f
cmp dword [ebp - 8], edi
jne 0xa9296f
cmp dword [ebp - 4], edi
jne 0xa9296f
mov eax, dword [ebp - 0xc]
test eax, eax
je 0xa9296f
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x9f1ef0
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xa929a6
cmp dword [ebp - 8], edi
jne 0xa929a6
cmp dword [ebp - 4], edi
jne 0xa929a6
mov eax, dword [ebp - 0xc]
cmp eax, 0x32
jbe 0xa929a6
mov dword [esi + 0x30], eax
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa94ab1
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
test byte [esi + 0x68], 2
jne 0xb3c555
mov al, 1
mov byte [ebp - 1], al
lea ecx, [ebp - 0xc]
movzx eax, al
push ecx
push 4
push eax
push 0xaab2c0
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov dword [ebp - 0x10], eax
test eax, eax
je 0xb3c56c
cmp byte [ebp - 1], bl
je 0xa94b0f
push 0xffffffffffffffff
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadPriority]
push 1
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadPriorityBoost]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
je 0xb3c5a2
cmp byte [ebp - 1], 0
je 0xb3c5d8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x9d3fb4
call fcn.00a95ad5
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
test dword [esi + 0x6c], 0x100
jne 0xa94acc
mov al, bl
mov byte [ebp - 1], bl
jmp 0xa94ad1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb3c583
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb3c58a
mov ebx, 0x80004005
mov ecx, dword [ebp + 4]
mov edx, 0x10b3
push ebx
push 0x9f6984
call fcn.00ab606d
jmp 0xa94b29
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb3c5b9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb3c5c0
mov ebx, 0x80004005
mov ecx, dword [ebp + 4]
mov edx, 0x10bc
push ebx
push 0x9f6984
call fcn.00ab606d
jmp 0xa94b1f
mov edx, dword [ebp - 0x10]
push 0x1d4c0
call fcn.00a4d587
cmp byte [esi + 0x78], 0
mov dword [ebp - 8], eax
je 0xa94b29
lea eax, [ebp - 8]
mov ecx, edi
push eax
push 0xa26908
call fcn.00c1712d
jmp 0xa94b29
Function at 0xa9883e
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x214], eax
push edi
test esi, esi
jne 0xb3ec9b
push ecx
mov edi, 0x104
mov dword [eax], ebx
mov edx, edi
mov dword [eax + 4], ebx
lea ecx, [ebp - 0x20c]
call fcn.00a535e0
push 0x9f2ca8
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.00a4355b
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov dword [ebp - 0x218], eax
test eax, eax
jne 0xa988e0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jne 0xb3eca2
lea ecx, [ebp - 0x218]
call fcn.00a98bef
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 8
lea edx, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
mov ecx, eax
call fcn.00a98e35
mov edi, eax
test edi, edi
js 0xb3ecbb
mov eax, dword [ebp - 0x210]
cdq
mov ecx, eax
test esi, esi
jne 0xa98917
mov eax, dword [ebp - 0x214]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0xa988c2
mov byte [esi], 1
jmp 0xa9890a
mov byte [esi], bl
jmp 0xa9886c
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x9f82f8
call fcn.00b5af13
mov ebx, eax
jmp 0xa988c2
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push edi
push 0x9f82f8
call fcn.00aa4c55
mov ebx, edi
jmp 0xa988c2
Function at 0xa9a990
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xcc
mov eax, 0xafeefd
call fcn.00af8e2b
mov esi, dword [ebp + 8]
xor ebx, ebx
push 1
push ebx
push 0x9f2ee8
push dword [esi + 0x38]
call dword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
test eax, eax
je 0xa9aab9
push 0x2000
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
jne 0xa9aab9
mov ecx, esi
call fcn.00a9ac5b
test al, al
je 0xa9aab9
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 0xd8]
call fcn.00a9aac3
mov dword [ebp - 4], ebx
mov eax, dword [esi]
mov dword [ebp - 0xd0], ebx
mov edi, dword [eax + 0x2c]
lea eax, [ebp - 0xd0]
push eax
cmp edi, fcn.00a9ab10
jne 0xb3fdba
mov ecx, esi
call fcn.00a9ab10
mov ecx, dword [ebp + 4]
mov edi, eax
test edi, edi
js 0xb3fdcb
push edi
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xcc]
call fcn.00a9ab9a
mov ecx, esi
call fcn.00a9ab2b
or esi, 0xffffffff
mov bl, 1
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xcc], 0x9d4574
test ecx, ecx
jne 0xb3fdde
mov eax, dword [ebp - 0xb4]
cmp dword [eax], 1
je 0xb3fe41
test ecx, ecx
jne 0xb3fe5c
lea ecx, [ebp - 0x20]
call fcn.00a48c27
lea ecx, [ebp - 0x88]
call fcn.00a7d7ad
cmp dword [ebp - 0xb0], 1
je 0xb3fe79
cmp dword [ebp - 0xbc], 0
mov dword [ebp - 0xb0], 3
jne 0xb3fe9b
xor eax, eax
call fcn.00af8dd5
ret 4
mov ecx, edi
call dword [0xc99200]
mov ecx, esi
call edi
jmp 0xa9aa28
push edi
push 0x9f4c78
push 0x3a
pop edx
call fcn.00ab606d
jmp 0xa9aa35
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xcc]
call fcn.00a90597
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0xb3fdfc
cmp dword [ecx], 1
je 0xb3fe1c
xor bl, bl
test ecx, ecx
je 0xb3fe1c
mov eax, esi
lock xadd dword [ecx], eax
jne 0xb3fe17
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0xb3fe17
push ecx
call fcn.00b67c3f
xor ecx, ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0xd4], 0
je 0xb3fe34
push dword [ebp - 0xd4]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x14]
test bl, bl
je 0xa9aa7a
jmp 0xa9aa6b
mov ecx, eax
call fcn.00b5e226
push ecx
lea ecx, [ebp - 0xcc]
call fcn.00ab6df8
mov ecx, dword [ebp - 0x14]
jmp 0xa9aa7a
lock xadd dword [ecx], esi
dec esi
jne 0xb3fe70
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0xb3fe70
push ecx
call fcn.00b67c3f
and dword [ebp - 0x14], 0
jmp 0xa9aa82
mov dword [ebp - 0xb0], 2
call fcn.00ab6005
lea edx, [ebp - 0xa8]
mov ecx, dword [eax + 4]
call fcn.00b5f842
jmp 0xa9aaa2
lea ecx, [ebp - 0xc8]
call fcn.00a59db6
jmp 0xa9aab9