joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f2e9be2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
je 0x7f2e9bf7
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp + 0xc], 0
push esi
je 0x7f2e9cc1
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x7f2e9cc1
mov eax, dword [0x7f307088]
imul eax, esi
inc eax
je 0x7f2e9c2c
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
jmp 0x7f2e9c2e
xor ebx, ebx
xor eax, eax
test ebx, ebx
je 0x7f2e9ccb
mov ecx, dword [0x7f307088]
imul ecx, esi
inc ecx
push edi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x7f307088]
imul eax, esi
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x7f2e9c8d
push dword [ebp + 0x10]
inc esi
push dword [ebp + 0xc]
push esi
push ebx
push edi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
cmp esi, edi
je 0x7f2e9cad
dec esi
jmp 0x7f2e9cad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x7f2e9ca7
cmp byte [ebx], 0
je 0x7f2e9ca7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
jmp 0x7f2e9c76
mov eax, dword [ebp + 0xc]
mov word [eax], di
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop edi
jmp 0x7f2e9ccb
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x7f2e9cd1
Capabilities:
Get graphical window text

Disassembly:
push 0x14
push 0x7f2fe978
call fcn.7f2fd948
xor edi, edi
push dword [ebp + 8]
cmp dword [0x7f307acc], edi
je 0x7f2e9cf5
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
jmp 0x7f2e9d98
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x7f2e9d96
mov eax, dword [0x7f307ac8]
cmp eax, 0x3a4
je 0x7f2e9d37
cmp eax, 0x3b5
je 0x7f2e9d37
cmp eax, 0x3b6
je 0x7f2e9d37
cmp eax, 0x3a8
je 0x7f2e9d37
cmp eax, 0x551
je 0x7f2e9d37
cmp eax, 0xd698
jne 0x7f2e9d96
mov dword [ebp - 4], edi
inc esi
mov dword [ebp - 0x24], esi
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x20], eax
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x7f2e9d8d
push edi
push edi
push esi
push dword [ebp - 0x20]
push edi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x7f2e9d8d
dec dword [ebp - 0x1c]
jmp 0x7f2e9d8d
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
jmp 0x7f2e9d98
mov eax, esi
lea esp, [ebp - 0x30]
call fcn.7f2fd983
ret 4
Function at 0x7f2ea766
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x10
push 0x7f2fe988
call fcn.7f2fd948
cmp dword [0x7f307acc], 0
je 0x7f2ea792
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x7f2ea830
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x7f2ea82e
mov edi, dword [ebp + 0x14]
mov eax, edi
dec edi
test eax, eax
je 0x7f2ea82e
push 6
movzx eax, word [ebp + 0xc]
shr eax, 4
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x7f2ea822
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x7f2ea822
and dword [ebp - 4], esi
and dword [ebp + 0xc], 0xf
movzx esi, word [eax]
mov dword [ebp - 0x1c], esi
inc eax
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
dec dword [ebp + 0xc]
test ecx, ecx
jne 0x7f2ea805
cmp esi, edi
jle 0x7f2ea7f6
mov esi, edi
mov dword [ebp - 0x1c], esi
push esi
push eax
push dword [ebp + 0x10]
call fcn.7f2daa3e
add esp, 0xc
jmp 0x7f2ea81e
lea eax, [eax + esi*2]
mov dword [ebp - 0x20], eax
jmp 0x7f2ea7d8
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
and word [eax + esi*2], 0
mov eax, esi
jmp 0x7f2ea830
xor eax, eax
call fcn.7f2fd983
ret 0x10

Function at 0x7f2ea838
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
je 0x7f2ea84b
pop ebp
jmp dword [sym.imp.USER32.dll_MapVirtualKeyW]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp dword [ebp + 0xc], 2
mov dword [ebp + 8], eax
jne 0x7f2ea8f4
test eax, eax
je 0x7f2ea8f4
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push eax
call fcn.7f2d4112
cmp eax, 0x3a4
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
je 0x7f2ea8dc
cmp eax, 0x3b5
je 0x7f2ea8dc
cmp eax, 0x3b6
je 0x7f2ea8dc
cmp eax, 0x3a8
je 0x7f2ea8dc
cmp eax, 0x551
je 0x7f2ea8dc
cmp eax, 0xd698
je 0x7f2ea8dc
and ecx, 0xffff
push 1
mov dword [ebp + 0xc], ecx
lea ecx, [ebp + 0xc]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, ax
je 0x7f2ea8f1
or byte [ebp + 0xf], 0x80
jmp 0x7f2ea8f1
push 1
lea ecx, [ebp + 0xc]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 0xc]
pop ebp
ret 8
Function at 0x7f2ea8f8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
je 0x7f2ea90b
pop ebp
jmp dword [sym.imp.USER32.dll_MapVirtualKeyExW]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp eax, dword [ebp + 0x10]
jne 0x7f2ea928
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.unicows.dll_MapVirtualKeyW
jmp 0x7f2ea9cd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
cmp dword [ebp + 0xc], 2
mov dword [ebp + 8], eax
jne 0x7f2ea9cd
test eax, eax
je 0x7f2ea9cd
movzx eax, word [ebp + 0x10]
push eax
call fcn.7f2d4112
cmp eax, 0x3a4
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
je 0x7f2ea9b5
cmp eax, 0x3b5
je 0x7f2ea9b5
cmp eax, 0x3b6
je 0x7f2ea9b5
cmp eax, 0x3a8
je 0x7f2ea9b5
cmp eax, 0x551
je 0x7f2ea9b5
cmp eax, 0xd698
je 0x7f2ea9b5
and ecx, 0xffff
push 1
mov dword [ebp + 0xc], ecx
lea ecx, [ebp + 0xc]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, ax
je 0x7f2ea9ca
or byte [ebp + 0xf], 0x80
jmp 0x7f2ea9ca
push 1
lea ecx, [ebp + 0xc]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 0xc]
pop ebp
ret 0xc

Function at 0x7f2ec291
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x7f307acc], 0
je 0x7f2ec2ac
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_VkKeyScanExW]
jmp 0x7f2ec2db
movzx eax, word [ebp + 0xc]
push eax
call fcn.7f2d4112
push 0
push 0
push 2
lea ecx, [ebp - 4]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
leave
ret 8
Function at 0x7f2ef7cd
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
push edi
je 0x7f2ef7ee
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x7f2ef88d
mov esi, dword [ebp + 0xc]
cmp esi, ebx
jne 0x7f2ef804
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x7f2ef88d
mov eax, dword [esi]
imul eax, dword [0x7f307088]
push eax
mov dword [ebp + 0xc], eax
call fcn.7f2d53a1
test eax, eax
mov edi, dword [ebp + 0xc]
je 0x7f2ef830
cmp edi, ebx
je 0x7f2ef830
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
test edi, edi
jbe 0x7f2ef838
test ebx, ebx
je 0x7f2ef7fd
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp + 0xc]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x7f2ef88b
cmp dword [ebp + 8], eax
je 0x7f2ef88b
cmp dword [ebp + 0xc], eax
je 0x7f2ef88b
push dword [esi]
push dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 8]
call fcn.7f2da99a
inc eax
pop ecx
mov dword [esi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x7f2efb38
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2efb58
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x7f2efbd9
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffff
jbe 0x7f2efbbd
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2efb9d
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2efb9d
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2efb9f
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2efbc1
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 0xc]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test ebx, ebx
jne 0x7f2efbcf
cmp dword [ebp + 0xc], 0
je 0x7f2efbcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x7f2efbd9
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x7f2efbe3
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2efc00
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x7f2efc6f
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffff
jbe 0x7f2efc65
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2efc45
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2efc45
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2efc47
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2efc65
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 0xc]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x7f2efc79
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
push edi
je 0x7f2efca0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x7f2efd35
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x7f2efcb6
push 0x57
pop eax
jmp 0x7f2efd35
mov eax, dword [0x7f307088]
imul eax, edi
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2efce4
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2efce4
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
test edi, edi
jbe 0x7f2efcfb
test ebx, ebx
jne 0x7f2efcfb
push 0x3e9
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x7f2efd35
imul esi, edi
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x7f2efd32
test edi, edi
jbe 0x7f2efd32
mov esi, dword [ebp + 0x10]
push edi
push esi
push 0xffffffffffffffff
push ebx
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and word [esi + edi*2 - 2], 0
mov eax, dword [ebp + 0x14]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x7f2efd3f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2efd75
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x7f2efea9
mov ebx, dword [ebp + 0x14]
cmp ebx, edi
je 0x7f2efdbc
mov eax, dword [ebx]
shl eax, 1
push eax
mov dword [ebp + 0x14], eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2efda5
cmp dword [ebp + 0x14], edi
je 0x7f2efda5
mov eax, dword [ebp + 0x14]
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 4], esp
jmp 0x7f2efda8
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], edi
jbe 0x7f2efdc2
cmp dword [ebp - 4], edi
jne 0x7f2efdc2
mov eax, 0x3e9
jmp 0x7f2efea9
mov dword [ebp + 0x14], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x20]
cmp eax, edi
je 0x7f2efe01
mov eax, dword [eax]
shl eax, 1
push eax
mov dword [ebp - 0xc], eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2efdf2
cmp dword [ebp - 0xc], edi
je 0x7f2efdf2
mov eax, dword [ebp - 0xc]
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 8], esp
jmp 0x7f2efdf5
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
jbe 0x7f2efe07
cmp dword [ebp - 8], edi
jne 0x7f2efe07
jmp 0x7f2efdb2
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
push dword [ebp + 0x24]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp + 0x14]
push dword [ebp + 0x18]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, edi
mov dword [ebp + 0x24], eax
jne 0x7f2efea6
cmp dword [ebp + 0x10], edi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
je 0x7f2efe64
cmp ebx, edi
je 0x7f2efe6a
push dword [ebx]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [ebp - 4]
push edi
push dword [0x7f307ac8]
call esi
cmp dword [ebp + 0x14], edi
je 0x7f2efe60
cmp eax, edi
jne 0x7f2efe60
mov dword [ebp + 0x24], 0x6f
mov dword [ebx], eax
jmp 0x7f2efe6a
cmp ebx, edi
je 0x7f2efe6a
mov dword [ebx], edi
cmp dword [ebp + 0x1c], edi
je 0x7f2efe9d
mov ebx, dword [ebp + 0x20]
cmp ebx, edi
je 0x7f2efea6
push dword [ebx]
push dword [ebp + 0x1c]
push 0xffffffffffffffff
push dword [ebp - 8]
push edi
push dword [0x7f307ac8]
call esi
cmp dword [ebp + 0x14], edi
je 0x7f2efe99
cmp eax, edi
jne 0x7f2efe99
mov dword [ebp + 0x24], 0x6f
mov dword [ebx], eax
jmp 0x7f2efea6
mov eax, dword [ebp + 0x20]
cmp eax, edi
je 0x7f2efea6
mov dword [eax], edi
mov eax, dword [ebp + 0x24]
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x7f2f0423
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
je 0x7f2f0436
pop ebp
jmp dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push esi
push dword [ebp + 0x34]
mov esi, dword [ebp + 0x2c]
push dword [ebp + 0x30]
push esi
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test esi, esi
je 0x7f2f0468
shl dword [esi], 1
pop esi
pop ebp
ret 0x30
Function at 0x7f2f06e5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2f070c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
jmp 0x7f2f081b
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x7f2f071b
push 0x57
pop eax
jmp 0x7f2f081b
mov eax, dword [eax]
imul eax, dword [0x7f307088]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffff
mov dword [ebp - 4], eax
jbe 0x7f2f078f
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2f076c
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2f076c
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2f076e
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2f078c
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 0xc]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 4]
push eax
call fcn.7f2d53a1
xor esi, esi
test eax, eax
je 0x7f2f07b0
cmp dword [ebp - 4], esi
je 0x7f2f07b0
mov eax, dword [ebp - 4]
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov esi, esp
cmp dword [ebp - 4], 0
jle 0x7f2f07ba
test esi, esi
je 0x7f2f07c3
test ebx, ebx
jne 0x7f2f07ca
cmp dword [ebp + 0xc], ebx
je 0x7f2f07ca
mov eax, 0x3e9
jmp 0x7f2f081b
lea eax, [ebp - 4]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov edi, eax
test edi, edi
jne 0x7f2f0819
test ebx, ebx
jne 0x7f2f07ef
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
add eax, eax
mov dword [ecx], eax
jmp 0x7f2f0819
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
shr eax, 1
push eax
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jg 0x7f2f0815
mov eax, dword [ebp - 4]
push 0x7a
pop edi
add eax, eax
mov dword [ebx], eax
mov eax, edi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7f2f0825
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor eax, eax
cmp dword [0x7f307acc], eax
push esi
push edi
je 0x7f2f0854
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x7f2f09b6
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffff
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jbe 0x7f2f08bf
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2f089f
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2f089f
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2f08a1
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2f08c3
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 0xc]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test ebx, ebx
jne 0x7f2f08d3
cmp dword [ebp + 0xc], 0
je 0x7f2f08d3
mov eax, 0x3e9
jmp 0x7f2f09b6
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call esi
mov ecx, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
cmp eax, edi
je 0x7f2f08fd
mov dword [eax], ecx
cmp dword [ebp + 0xc], edi
jne 0x7f2f09b3
cmp dword [ebp + 0x1c], edi
je 0x7f2f09b3
cmp ecx, edi
jbe 0x7f2f09a0
cmp ecx, 2
jbe 0x7f2f0921
cmp ecx, 7
jne 0x7f2f09a0
push dword [ebp - 4]
call fcn.7f2d53a1
test eax, eax
je 0x7f2f0941
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x7f2f0941
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
cmp dword [ebp - 4], 0
jbe 0x7f2f094f
test edi, edi
je 0x7f2f08c9
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call esi
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx]
lea esi, [ecx + ecx]
cmp esi, eax
jbe 0x7f2f0980
test eax, eax
je 0x7f2f099c
mov dword [ebp + 0xc], 0xea
jmp 0x7f2f099c
cmp dword [ebp + 0x18], 0
je 0x7f2f099c
shr eax, 1
push eax
push dword [ebp + 0x18]
push ecx
push edi
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebx], esi
jmp 0x7f2f09b3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call esi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x7f2f0cf7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
push edi
je 0x7f2f0d22
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
jmp 0x7f2f0e24
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x7f2f0d8b
push eax
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2f0d67
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2f0d67
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 4], esp
jmp 0x7f2f0d6a
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x7f2f0d93
imul esi, edi
push ebx
push ebx
push esi
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
push ebx
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x7f2f0d8e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jne 0x7f2f0da2
cmp dword [ebp + 0xc], ebx
je 0x7f2f0da2
mov eax, 0x3e9
jmp 0x7f2f0e24
mov ebx, dword [ebp + 0x14]
cmp ebx, 0xffff
jbe 0x7f2f0e07
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2f0de7
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2f0de7
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2f0de9
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2f0e0b
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 0x14]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test ebx, ebx
jne 0x7f2f0e11
cmp dword [ebp + 0x14], 0
jne 0x7f2f0d98
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x14