joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaa07e6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0xb42280
push ebx
push esi
push 0xb7b660
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolTimer]
mov dword [esi], eax
test eax, eax
je 0xb422b2
mov edi, ebx
push 4
pop eax
cmp dword [esi + 8], ebx
jne 0xb422a4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
push 8
push 0x9f43a0
push 0x9f02f0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
mov edi, dword [esp + 0xc]
test edi, edi
je 0xaa08a6
xor ebx, ebx
mov ecx, edi
cmp dword [esi + 8], 4
sete bl
dec ebx
and ebx, 0xfff7c2a0
add ebx, 0x927c0
mov edx, ebx
call fcn.00aa08e7
cmp dword [esi + 8], 0
jne 0xaa0892
cmp eax, 0x927c0
jbe 0xaa0892
mov dword [esi + 8], 4
mov ecx, dword [esi]
push ebx
push 0
push eax
call fcn.00aa08ad
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00b76cfd
jmp 0xaa085f
push ebx
push ebx
push ebx
push dword [esi]
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolTimer]
push 1
push dword [esi]
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_WaitForThreadpoolTimerCallbacks]
push dword [esi]
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CloseThreadpoolTimer]
mov dword [esi], ebx
jmp 0xaa0800
cmp dword [esi + 8], eax
jne 0xaa08a6
jmp 0xaa0825
mov eax, 0x80004005
jmp 0xaa089f

Function at 0xaa1602
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, ebx
mov ecx, dword [edi + 0xbc]
call fcn.00aae35d
test al, al
je 0xaa166f
push ebx
push ebx
push edi
push 0xaa7000
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov dword [edi + 0xbc], eax
test eax, eax
je 0xb42316
test esi, esi
js 0xaa166f
push ebx
push edi
push 0xc11000
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWait]
mov dword [edi + 0xb8], eax
test eax, eax
je 0xb42334
push ebx
push dword [edi + 0xbc]
mov esi, ebx
push eax
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolWait]
mov dword [edi + 0xb8], ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xb4232d
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xb42351
jmp 0xaa163a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xb4234b
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xaa166f
mov esi, 0x80004005
jmp 0xaa166f
Function at 0xaa17fb
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
push ecx
push ecx
xor esi, esi
mov ecx, 0xc96cf0
push esi
call fcn.00aa187a
mov edi, 0xc96c00
mov ecx, edi
call fcn.00ab2d79
push edi
mov ecx, 0xc969fc
call fcn.00aa1a1f
test eax, eax
js 0xb4235b
mov eax, dword [0xc95944]
mov ecx, fcn.00aa4fb0
test eax, eax
jne 0xb42375
push 0xaa09d0
push 0x282a
push 0xc969e0
push 0xa99be0
mov dword [0xc95944], ecx
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
test eax, eax
je 0xaa1874
cmp dword [0xc969e4], esi
je 0xaa1874
xor esi, esi
inc esi
mov eax, esi
pop edi
pop esi
leave
ret
mov ecx, dword [ebp + 4]
mov edx, 0x1b5
push eax
push 0x9f9bd4
call fcn.00ab606d
xor eax, eax
jmp 0xaa1876
cmp eax, ecx
je 0xaa1845
push 0x50
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00ab4bf6
add esp, 0xc
lea ecx, [ebp - 0x50]
call fcn.00b5b5eb
int3

Function at 0xaa2140
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x9f4464
push dword [0xc96e60]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jg 0xb42428
js 0xaa2196
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x9f4448
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop esi
leave
ret
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xaa2174

Function at 0xaa225d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetSpecialFolderPathW]
push 1
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetSpecialFolderPathW]
push 1
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetSpecialFolderPathW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ab3c50
leave
ret
Function at 0xaa2716
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 4
pop edi
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push 0x9f4974
push 0x9f48c8
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
cmp eax, 2
je 0xb42757
cmp eax, 3
je 0xb42757
pop edi
pop esi
leave
ret
push ebx
push 0x1d
call dword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
test eax, eax
je 0xb4281a
push 0x220
push esi
call dword [sym.imp.SHELL32.dll_SHTestTokenMembership]
xor ebx, ebx
inc ebx
test eax, eax
jne 0xb427cf
push 0x225
push esi
call dword [sym.imp.SHELL32.dll_SHTestTokenMembership]
test eax, eax
jne 0xb427cf
push 0x227
push esi
call dword [sym.imp.SHELL32.dll_SHTestTokenMembership]
test eax, eax
jne 0xb427cf
push 0x22c
push esi
call dword [sym.imp.SHELL32.dll_SHTestTokenMembership]
test eax, eax
jne 0xb427cf
lea edx, [ebp - 0xc]
mov dword [ebp - 4], esi
call fcn.00a849b4
test eax, eax
jne 0xb427d2
mov eax, dword [ebp - 0xc]
test eax, eax
je 0xb427cf
cmp eax, ebx
je 0xb427cf
cmp eax, 0x10
je 0xb427cf
cmp eax, 0x11
jne 0xb427d2
mov dword [ebp - 4], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xa154ec
mov esi, 0x9f48c8
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
cmp eax, 2
je 0xb427fe
cmp eax, 3
jne 0xb42822
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push edi
push 0xa154ec
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
jmp 0xb42822
mov dword [ebp - 4], esi
mov esi, 0x9f48c8
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x9f4974
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
pop ebx
jmp 0xaa2758

Function at 0xaa27c0
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x9f4848
push 0x9f4814
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
jne 0xb428b3
call dword [sym.imp.api_ms_win_core_localization_obsolete_l1_2_0.dll_GetUserDefaultUILanguage]
cmp word [ebp - 4], ax
jne 0xb428b3
leave
ret
push esi
push 0xa15434
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0xb428ea
push edi
push 0xa1541c
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0xb428e2
mov ecx, edi
call dword [0xc99200]
call edi
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
pop edi
pop esi
leave
ret
Function at 0xaa28c0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
mov edx, 0x9f4798
push eax
push 2
push 0x9f4804
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00aac1c5
test eax, eax
jns 0xb42991
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ab3c50
leave
ret
cmp word [ebp - 0x20c], 0
je 0xaa28ff
push esi
push 0x40
xor esi, esi
mov dword [ebp - 0x260], 0x44
lea eax, [ebp - 0x25c]
push esi
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
inc eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
pop esi
test eax, eax
je 0xaa28ff
mov ecx, dword [ebp - 0x21c]
call fcn.00c54347
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0xaa28ff
Function at 0xaa5718
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push 2
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20000070
push ecx
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
jle 0xaa573e
cmp dword [ebp - 4], 1
sete bl
mov eax, ebx
pop ebx
leave
ret
Function at 0xaa6b9e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0xaff9c6
call fcn.00af8e2b
mov eax, ecx
mov dword [ebp - 0x2c], eax
xor bl, bl
cmp dword [eax + 0x10], 0
je 0xb4efb5
and dword [ebp - 0x28], 0
and dword [ebp - 4], 0
push 1
push 0x9f4f00
push 0x9f4e38
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_stream_l1_1_0.dll_SHOpenRegStream2W]
push eax
lea ecx, [ebp - 0x28]
call fcn.00a50bea
cmp dword [ebp - 0x28], 0
je 0xaa6c45
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x24], 0x14
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0x10001
push dword [edi + 0x10]
call fcn.00aa6d5a
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0xaa6c45
push 0x14
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_shcore_stream_l1_1_0.dll_IStream_Write]
test eax, eax
js 0xaa6c45
push dword [ebp - 0x28]
push dword [edi + 0x10]
call fcn.00aa6d17
test eax, eax
setne bl
lea ecx, [ebp - 0x28]
call fcn.00a398c6
test bl, bl
je 0xb4efb5
mov al, bl
call fcn.00af8dd5
ret
lea eax, [ebp - 0x28]
push eax
push 0x20006
push 0
push 0x9f4e38
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xaa6c55
push 0x9f4f00
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xaa6c55

Function at 0xaa7b0e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
push edi
push eax
lea eax, [ebp - 8]
mov byte [ebx], 0
push eax
xor edi, edi
mov dword [ebp - 4], 4
push edi
push 0x10
push 0x9f5044
push 0x9f4fc0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jg 0xb54dcb
js 0xb54ddb
mov edi, dword [ebp - 8]
xor esi, esi
test esi, esi
js 0xb54e02
test edi, edi
setne al
mov byte [ebx], al
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xaa7b51
push 0x9f5044
push 0x9f4fc0
push 0xa2083c
push esi
push 0xa207e8
push 0x4f
push dword [ebp + 4]
call fcn.00b86ae3
add esp, 0x1c
jmp 0xaa7b5c
push 0x9f5044
push 0x9f4fc0
push 0xa2083c
push esi
push 0xa2496c
push 0x12b
push dword [ebp + 4]
call fcn.00b86ae3
add esp, 0x1c
mov eax, esi
jmp 0xaa7b6d
Function at 0xaa7b74
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
xor ecx, ecx
mov edi, 0x9f5044
push ecx
push ecx
push 0xffff
push edi
push 0x9f4fc0
push reloc.SHCORE.dll_Ordinal_1
mov byte [esi], cl
mov dword [ebp - 4], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test ebx, ebx
jg 0xb54e2e
js 0xb54e3e
shr ebx, 0x1f
xor bl, 1
xor eax, eax
mov byte [esi], bl
pop edi
pop esi
pop ebx
leave
ret 4
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jmp 0xaa7bb2
cmp ebx, 0x80070002
je 0xaa7bb8
push edi
push 0x9f4fc0
push 0xa2083c
push ebx
push 0xa2496c
push 0xfd
push dword [ebp + 4]
call fcn.00b86ae3
add esp, 0x1c
mov eax, ebx
jmp 0xaa7bc2

Function at 0xaa8633
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xaffb8b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x234], ecx
and dword [ebp - 4], 0
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
push 0x9f50e8
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xb5555e
mov byte [ebp - 4], 0
cmp dword [ebp - 0x220], 0
je 0xaa86b6
push dword [ebp - 0x220]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00ab3c50
leave
ret
xor eax, eax
mov esi, eax
mov dword [ebp - 0x224], eax
mov ebx, eax
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], 2
mov edi, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push dword [ebp - 0x220]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0xb555fc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00b7d7e4
mov ebx, dword [ebp - 0x228]
inc edi
mov esi, dword [ebp - 0x22c]
xor eax, eax
jmp 0xb5557c
mov eax, ebx
mov ecx, dword [ebp - 0x234]
sub eax, esi
push 0x18
cdq
pop edi
idiv edi
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x230]
push eax
call fcn.00b7d165
cmp esi, ebx
je 0xb55652
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0xb5562c
mov ecx, dword [esi]
call fcn.00b7e4e6
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xb55648
push eax
push 0x9fa1a0
mov edx, 0x84
call fcn.00ab606d
add esi, edi
cmp esi, dword [ebp - 0x228]
jne 0xb55622
lea ecx, [ebp - 0x22c]
call fcn.00b7f650
jmp 0xaa869d
Function at 0xaab03d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
lea eax, [ebp - 8]
mov edi, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jg 0xb563cd
js 0xaab0f1
cmp dword [ebp - 8], 1
mov eax, dword [ebp - 4]
jne 0xb563dd
test eax, eax
je 0xb563e7
test al, 1
jne 0xb563e7
test esi, esi
js 0xaab0f1
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov edi, eax
test edi, edi
je 0xaab101
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jg 0xb563f1
js 0xaab0f1
mov ebx, dword [ebp - 4]
shr ebx, 1
dec ebx
cmp dword [ebp - 8], 2
je 0xb56401
test esi, esi
js 0xaab0f1
xor eax, eax
cmp word [edi + ebx*2], ax
jne 0xaab108
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + 1]
push eax
push edi
call fcn.00aab10f
xor eax, eax
mov edi, eax
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
mov esi, 0x8007000e
jmp 0xaab0f1
mov esi, 0x8007000d
jmp 0xaab0f1
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xaab072
cmp dword [ebp - 8], 2
je 0xaab081
mov esi, 0x8007000d
jmp 0xaab091
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xaab0c2
xor eax, eax
push eax
push eax
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0xaab0d4
lea ecx, [eax + eax]
push ecx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0xaab101
mov esi, dword [ebp - 0x10]
push esi
push eax
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0xb56458
cmp eax, esi
ja 0xb56458
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
dec ebx
jmp 0xaab0d8
push dword [ebp - 0xc]
mov esi, 0x8007007a
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xaab0d4
Function at 0xaabba8
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [ebp - 8], esi
push edi
mov dword [ebp - 0x10], ebx
mov ecx, ebx
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
movzx eax, word [eax + 4]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0xb56969
mov eax, ebx
mov edi, ebx
test eax, eax
jne 0xb56994
mov esi, dword [ebp - 0x14]
mov ecx, ebx
mov eax, dword [ebp - 8]
movzx esi, word [esi + 6]
mov eax, dword [eax + 0x1c]
test esi, esi
jne 0xb56a7c
mov eax, edi
mov dword [edx + 0x10], ebx
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, edi
mov edi, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
cmp dword [eax], edx
mov edx, dword [ebp - 4]
jne 0xb569c0
cmp dword [ebp + 0xc], ebx
je 0xb569a5
cmp dword [esi + 0x20], ebx
je 0xb569a5
test byte [eax + 4], 1
jne 0xb569c0
imul esi, ecx, 0xc
lea edi, [ebp - 0x24]
add esi, dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp + 0xc], ebx
je 0xb569d8
mov eax, dword [ebp - 8]
cmp dword [eax + 0x20], ebx
je 0xb569d8
push 0xc
jmp 0xb569da
test byte [eax + 4], 1
lea edi, [ebp - 0x24]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0xb569d0
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], 1
inc ecx
add eax, 0xc
cmp ecx, edi
jb 0xb5696e
mov eax, dword [ebp - 0x10]
jmp 0xaabbdf
xor eax, eax
inc eax
jmp 0xaabbdf
push 8
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
pop eax
mov eax, dword [eax + ecx]
test al, 4
je 0xb569f1
and esi, 0xffffcfff
mov dword [ebp - 0x20], esi
test al, 2
je 0xb569fe
and esi, 0xfffff3ff
mov dword [ebp - 0x20], esi
test al, 1
je 0xb56a0b
and esi, 0xfffffcff
mov dword [ebp - 0x20], esi
test al, 8
je 0xb56a1b
and esi, 0xc0ffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x24]
mov edi, ebx
call fcn.00b5b962
mov edx, dword [ebp - 4]
test eax, eax
je 0xaabbe9
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0xc], eax
mov eax, esi
shr eax, 0x1e
mov dword [edx + 8], eax
mov eax, esi
shr eax, 0x18
and al, 0x3f
mov byte [edx + 4], al
mov eax, esi
shr eax, 1
and eax, 1
mov dword [edx + 0x14], eax
mov eax, esi
shr eax, 0xc
and eax, 3
jne 0xb56a72
mov eax, esi
shr eax, 0xa
and eax, 3
jne 0xb56a72
shr esi, 8
and esi, 3
je 0xb56a74
mov dword [edx], esi
jmp 0xb56a74
mov dword [edx], eax
xor edi, edi
inc edi
jmp 0xaabbe9
mov edx, dword [ebp + 8]
cmp dword [eax], edx
mov edx, dword [ebp - 4]
je 0xb56a93
inc ecx
add eax, 0x10
cmp ecx, esi
jb 0xb56a7c
jmp 0xaabc00
xor ebx, ebx
inc ebx
jmp 0xaabc00
Function at 0xaabef9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
or edi, 0xffffffff
mov dword [esi + 0x14], eax
test eax, eax
je 0xaabfad
push ebx
push 1
xor edi, edi
mov ebx, 0x9f02f0
push edi
push 0x9f65c8
push ebx
call dword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
neg eax
mov edx, 0x9f6590
push 0x1f4
sbb al, al
mov ecx, ebx
inc al
mov byte [esi + 0x53], al
call fcn.00a57919
push esi
push dword [esi + 0x14]
mov dword [esi + 0x38], eax
call dword [sym.imp.ole32.dll_RegisterDragDrop]
push 0xc
xor ecx, ecx
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], edi
push eax
inc ecx
push ecx
push edi
push dword [esi + 0x14]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_SetGestureConfig]
mov ecx, esi
call fcn.00aabfbf
mov ebx, dword [esi + 0x68]
add esi, 0x64
mov ecx, esi
mov eax, dword [ebx]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x14], eax
call fcn.00a80059
mov eax, dword [ebp - 0x14]
push esi
push ebx
cmp eax, fcn.00a86c30
jne 0xb56c89
call fcn.00a86c30
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret 4
mov ecx, eax
call dword [0xc99200]
mov eax, dword [ebp - 0x14]
call eax
jmp 0xaabfac

Function at 0xaacf32
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x1000b
push 0
push 0x9f67e8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xb571ac
push 0x9f67bc
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
cmp dword [ebp - 4], 0
je 0xaacf7c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
leave
ret
mov ecx, dword [ebp + 4]
push eax
push 0x9fe4a4
push 0x26
pop edx
call fcn.00b5b6e5
jmp 0xaacf6d