joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc0177d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
mov edi, edx
push eax
push 0
push 2
push ecx
push 0x9f6c20
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jle 0xc017c8
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc0180c
cmp word [ebp - 0x14], 0x23
jne 0xc01807
push 0x10
lea eax, [ebp - 0x12]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstol]
mov ecx, eax
add esp, 0xc
movzx edx, cl
or edx, 0xffffff00
sar eax, 8
shl edx, 8
movzx eax, al
or edx, eax
sar ecx, 0x10
shl edx, 8
movzx eax, cl
or edx, eax
mov dword [edi], edx
jmp 0xc0180c
mov esi, 0x80070057
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret

Function at 0xc01e60
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
mov esi, ebx
push edi
mov edi, ecx
cmp dword [0xc96f7c], ebx
jne 0xc01f24
push 0x2001f
lea ecx, [ebp - 0xc]
call fcn.00a7f468
mov eax, dword [0xc97ae0]
test eax, eax
jne 0xc01e96
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 2
push ebx
push ebx
push ebx
push 0x9ee878
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jle 0xc01ebe
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc01f16
push 4
push edi
push 4
push ebx
push 0x9ee90c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0xc01ee5
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc01f0d
push 4
lea eax, [edi + 4]
push eax
push 4
push ebx
push 0x9ee8ec
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0xc01f0d
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0xc01f24
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xc034fc
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, edx
call fcn.00c03142
mov esi, eax
test esi, esi
jns 0xc03529
mov ecx, dword [ebp + 4]
mov edx, 0x279
push esi
push 0x9fdf00
call fcn.00aa4c55
jmp 0xc035bb
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 2
push esi
push esi
push esi
push 0x9ee878
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0xc03569
push 0x20
push 0xc960e0
push 3
push esi
push 0x9ee950
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0xc0358a
cmp byte [ebp + 8], 0
je 0xc0358a
test edi, edi
je 0xc0358a
mov ecx, dword [ebp + 4]
mov edx, 0x28c
push edi
push 0x9fdf00
call fcn.00b667e8
mov esi, eax
jmp 0xc035ac
mov ecx, dword [0xc960ec]
call fcn.00c035c3
test edi, edi
je 0xc035ac
mov ecx, dword [ebp + 4]
mov edx, 0x295
push edi
push 0x9fdf00
call fcn.00b5b6e5
cmp dword [ebp - 4], 0
je 0xc035bb
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0xc046fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 8
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push ebx
push esi
push 0xa23de0
push 0xa23df8
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xc04769
cmp dword [ebp - 4], esi
jne 0xc04769
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jb 0xc04769
ja 0xc04752
cmp eax, dword [ebp - 0xc]
jbe 0xc04769
sub eax, dword [ebp - 0xc]
sbb ecx, dword [ebp - 8]
cmp ecx, 0xc9
jb 0xc0476b
ja 0xc04769
cmp eax, 0x2a69c000
jb 0xc0476b
mov bl, 1
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0xc04771
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x44
push ebx
push esi
push edi
push 0x64
mov esi, ecx
xor ebx, ebx
pop ecx
mov edi, ebx
cmp cx, ax
jne 0xc048b0
shr eax, 0x10
xor ecx, ecx
cmp cx, ax
jne 0xc048b0
push dword [esi + 0xc0]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
cmp dword [0xc93498], 5
jbe 0xc047f6
push 0x2000
push ebx
mov ecx, 0xc93498
call fcn.00a5996e
test al, al
je 0xc047f6
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
sub eax, dword [esi + 0xd0]
mov edx, 0xa10481
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ecx
push ebx
mov ecx, 0xc93498
call fcn.00ab10b0
cmp byte [esi + 0xac], bl
je 0xc048b0
push 0x90
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowPos]
test eax, eax
je 0xc048b0
mov ecx, esi
mov byte [esi + 0xad], bl
call fcn.00c04552
lea eax, [ebp - 4]
mov byte [esi + 0xac], bl
push eax
push 0x9efee4
push 0x9f6410
push ebx
push 0x9f76dc
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHCreateItemInKnownFolder]
mov edi, eax
test edi, edi
js 0xc048a8
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_SHGetIDListFromObject]
mov edi, eax
test edi, edi
js 0xc048a8
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00ab4bf6
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0xc
push eax
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x30], 0xa23dac
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
lea ecx, [ebp - 4]
call fcn.00a39d42
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xc08d94
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 6
push esi
push esi
push esi
push 0xa23df8
push reloc.SHCORE.dll_Ordinal_1
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0xc08e0f
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0xc]
push eax
push 3
push 0xa23de0
push esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
jne 0xc08e0f
cmp dword [0xc93498], 5
jbe 0xc08e0f
push 0x2000
push esi
mov ecx, 0xc93498
call fcn.00a5996e
test al, al
je 0xc08e0f
push ecx
push esi
mov edx, 0xa104b6
call fcn.00a468e5
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0xc08e20
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop esi
leave
ret
Function at 0xc17ede
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0xb06330
call fcn.00af8df7
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0xc17fae
mov esi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0xc17fae
xor ebx, ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
mov edx, 0x9fe5c8
push eax
mov ecx, 0x9fe6b4
mov dword [ebp - 0x14], ebx
call fcn.00c1c55b
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xc17f36
push eax
push 0x9fe6cc
mov edx, 0x42f
call fcn.00ab606d
jmp 0xc17f9a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push 0xf003f
push ebx
push dword [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ecx, dword [ebp + 4]
test eax, eax
je 0xc17f5f
mov edx, 0x432
jmp 0xc17f81
push 0x10
push dword [ebp + 8]
push 3
push ebx
push 0x9fe658
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ecx, dword [ebp + 4]
test eax, eax
je 0xc17f8c
mov edx, 0x435
push eax
push 0x9fe6cc
call fcn.00b5b6e5
cmp dword [ebp - 0x10], ebx
je 0xc17f9a
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov byte [esi], bl
cmp dword [ebp - 0x14], ebx
je 0xc17fae
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
call fcn.00af8dc0
ret 0x14

Function at 0xc17fb8
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0xb06330
call fcn.00af8df7
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0xc18088
mov esi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0xc18088
xor ebx, ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
mov edx, 0x9fe5c8
push eax
mov ecx, 0x9fe6b4
mov dword [ebp - 0x14], ebx
call fcn.00c1c55b
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xc18010
push eax
push 0x9fe6cc
mov edx, 0x42f
call fcn.00ab606d
jmp 0xc18074
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push 0xf003f
push ebx
push dword [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ecx, dword [ebp + 4]
test eax, eax
je 0xc18039
mov edx, 0x432
jmp 0xc1805b
push 0xc
push dword [ebp + 8]
push 3
push ebx
push 0x9fe634
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ecx, dword [ebp + 4]
test eax, eax
je 0xc18066
mov edx, 0x435
push eax
push 0x9fe6cc
call fcn.00b5b6e5
cmp dword [ebp - 0x10], ebx
je 0xc18074
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov byte [esi], bl
cmp dword [ebp - 0x14], ebx
je 0xc18088
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
call fcn.00af8dc0
ret 0x14
Function at 0xc18090
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0xb06330
call fcn.00af8df7
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0xc18163
mov esi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0xc18163
xor ebx, ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
mov edx, 0x9fe5c8
push eax
mov ecx, 0x9fe6b4
mov dword [ebp - 0x14], ebx
call fcn.00c1c55b
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xc180e8
push eax
push 0x9fe6cc
mov edx, 0x42f
call fcn.00ab606d
jmp 0xc1814f
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push 0xf003f
push ebx
push dword [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ecx, dword [ebp + 4]
test eax, eax
je 0xc18111
mov edx, 0x432
jmp 0xc18136
push 0xac
push dword [ebp + 8]
push 3
push ebx
push 0x9fe668
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ecx, dword [ebp + 4]
test eax, eax
je 0xc18141
mov edx, 0x435
push eax
push 0x9fe6cc
call fcn.00b5b6e5
cmp dword [ebp - 0x10], ebx
je 0xc1814f
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov byte [esi], bl
cmp dword [ebp - 0x14], ebx
je 0xc18163
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
call fcn.00af8dc0
ret 0x14
Function at 0xc19c3a
Capabilities:
Compare security identifiers

Disassembly:
push 0x44
mov eax, 0xb06581
call fcn.00af8e2b
mov eax, ecx
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push ecx
xor edi, edi
lea ecx, [ebp - 0x24]
push edi
push ecx
push edi
push edi
push 4
push 4
push eax
mov dword [ebp - 0x28], edi
call dword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_GetNamedSecurityInfoW]
test eax, eax
je 0xc19c82
mov ecx, dword [ebp + 4]
mov edx, 0xf7
push eax
push 0xa253d4
call fcn.00b667e8
jmp 0xc19ca9
push 2
push 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
test eax, eax
jne 0xc19cb0
mov ecx, dword [ebp + 4]
mov edx, 0xfa
push 0xa253d4
call fcn.00b5af13
mov edi, eax
jmp 0xc19d90
mov esi, edi
cmp dword [ebp - 0x1c], esi
jbe 0xc19ce5
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
je 0xc19cdf
mov eax, dword [ebp - 0x2c]
push ebx
add eax, 8
push eax
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0xc19d90
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0xc19cb7
xor esi, esi
mov dword [ebp - 0x44], edi
inc esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x50], SysReAllocString
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], edi
mov ebx, edi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], edi
test ebx, ebx
je 0xc19d31
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor esi, esi
inc esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetEntriesInAclW]
test eax, eax
je 0xc19d4e
mov edx, 0x112
jmp 0xc19d6a
push edi
push dword [ebp - 0x20]
push edi
push edi
push 4
push 4
push dword [ebp - 0x30]
call dword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetNamedSecurityInfoW]
test eax, eax
je 0xc19d7a
mov edx, 0x113
mov ecx, dword [ebp + 4]
push eax
push 0xa253d4
call fcn.00b667e8
mov edi, eax
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0
je 0xc19d8c
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0
je 0xc19da6
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.00af8dd5
ret 4
Function at 0xc1b45e
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push ecx
mov edi, 0x9f3cc8
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0xa153ac
mov edx, edi
mov ecx, esi
call fcn.00a41860
cmp dword [ebp - 4], 0
je 0xc1b4b0
push ecx
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 2
push eax
push 4
push 0x9fe3d0
mov edx, 0x9f3d98
mov ecx, esi
call fcn.00b6073b
jmp 0xc1b4c1
push 0x9fe3d0
push 0x9f3d98
push esi
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
push 0x9f3d70
push edi
push esi
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
pop edi
xor eax, eax
pop esi
leave
ret

Function at 0xc1bc42
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
mov ebx, 0xa1c674
push eax
push 0
push 0x10
push ebx
mov edi, ecx
push 0xa1c6b8
push reloc.OLEAUT32.dll_SysReAllocString
and dword [edi], 0
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jle 0xc1bc8c
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xc1bcb6
cmp esi, 0x80070002
je 0xc1bcbb
push ebx
push 0xa1c6b8
push 0xa2083c
push esi
push 0xa207e8
push 0x4f
push dword [ebp + 4]
call fcn.00b86ae3
add esp, 0x1c
jmp 0xc1bcbd
mov eax, dword [ebp - 8]
mov dword [edi], eax
xor esi, esi
test esi, esi
jns 0xc1bcd4
mov ecx, dword [ebp + 4]
mov edx, 0x1b1
push esi
push 0xa2496c
call fcn.00aa4c55
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0xc1c050
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xc8
lea eax, [ebp - 0xcc]
mov esi, ecx
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xd0], 0x64
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xc
call dword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
je 0xc1c0cc
lea eax, [ebp - 0xcc]
push 0x9ede5c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscspn]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0x64
push esi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcsncpy_s]
add esp, 0x18
mov al, 1
jmp 0xc1c0ce
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret
Function at 0xc1c138
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
mov edi, 0x80
xor ebx, ebx
push edi
push ebx
push eax
mov dword [esi], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x88], edi
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push ebx
push 0x20000002
push 0xa24c1c
push 0xa24c60
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
lea ecx, [ebp - 0x84]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc1c1a5
sub ecx, edx
lea eax, [ebp - 0x84]
push esi
sar ecx, 1
push ecx
push ecx
push eax
call fcn.00a54bd0
mov esi, eax
test esi, esi
jns 0xc1c1e0
mov ecx, dword [ebp + 4]
mov edx, 0x462
push esi
push 0x9fe6cc
call fcn.00aa4c55
mov eax, esi
jmp 0xc1c1e2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 4

Function at 0xc1c1f3
Capabilities:
Get common file path

Disassembly:
push 0x418
mov eax, 0xb067bc
call fcn.00af8e2b
mov ebx, edx
mov edi, ecx
xor esi, esi
mov dword [ebx], esi
mov dword [ebp - 0x424], esi
lea ecx, [ebp - 0x424]
mov dword [ebp - 4], esi
call fcn.00a398c6
lea eax, [ebp - 0x424]
push eax
push 0xa1c4f4
push 1
push esi
push 0xa23d8c
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0xc1c248
mov edx, 0x148
jmp 0xc1c304
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x420]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
je 0xc1c28f
push 0x9f0238
lea eax, [ebp - 0x420]
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
xor edx, edx
sub edi, edx
je 0xc1c2d6
sub edi, 1
je 0xc1c2a6
mov esi, 0x80070057
mov edx, 0x16d
jmp 0xc1c304
mov eax, dword [ebp - 0x424]
push edx
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
lea ecx, [ebp - 0x218]
push ecx
push 0xa259f8
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
jns 0xc1c314
mov edx, 0x165
jmp 0xc1c304
mov eax, dword [ebp - 0x424]
push edx
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
lea ecx, [ebp - 0x218]
push ecx
push 0x9f00d4
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
jns 0xc1c314
mov edx, 0x169
mov ecx, dword [ebp + 4]
push esi
push 0xa258bc
call fcn.00aa4c55
jmp 0xc1c325
mov eax, dword [ebp - 0x424]
and dword [ebp - 0x424], 0
xor esi, esi
mov dword [ebx], eax
lea ecx, [ebp - 0x424]
call fcn.00a398c6
mov eax, esi
call fcn.00af8dd5
ret 4
Function at 0xc1c74a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xc9531c]
sub esp, 0x10
cmp eax, 0xffffffff
jne 0xc1c7bb
push ebx
push esi
push edi
push 4
pop ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 4]
mov edi, 0x20010010
push eax
push 0
push edi
push 0xa25678
mov esi, 0xa255e0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0xa25648
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
jne 0xc1c7bb
mov dword [0xc9531c], eax
leave
ret

Function at 0xc1cda4
Capabilities:
Compare security identifiers

Disassembly:
push 8
mov eax, 0xaff109
call fcn.00af8df7
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov esi, eax
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.00a9cf4b
test eax, eax
js 0xc1cdf6
and dword [ebp - 0x14], esi
lea ecx, [ebp - 0x14]
call fcn.00aa25f0
mov esi, dword [ebp - 0x14]
test eax, eax
js 0xc1cdf6
push esi
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0xc1cdf8
xor bl, bl
mov byte [ebp - 4], 3
test esi, esi
je 0xc1ce07
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x10], 0
je 0xc1ce1d
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
mov al, bl
call fcn.00af8dc0
ret
Function at 0xc468b9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0
push 0
push 2
push 0x9f2b98
push 0xa251d8
push reloc.OLEAUT32.dll_SysReAllocString
inc ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xc4693e
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push 0
push 2
push 0x9f2b98
push 0xa251d8
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xc46931
push ebx
push 0xffffffffffffffff
push 0xa251bc
push 0xffffffffffffffff
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
jne 0xc4693c
xor bl, bl
test esi, esi
je 0xc4693c
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret