joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa9c071
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0xafef7b
call fcn.00af8df7
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
test ecx, ecx
jne 0xa9c0fa
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push dword [edi]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xa9c0d8
push 4
pop edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push 0x9f30e8
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0xb40467
mov dword [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0xa9c0ee
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00af8dc0
ret
call fcn.00b66803
jmp 0xa9c091
cmp dword [ebp - 0x1c], edi
jne 0xa9c0d8
mov esi, dword [ebp - 0x14]
jmp 0xa9c0d8

Function at 0xa9cee5
Capabilities:
Compare security identifiers

Disassembly:
push 8
mov eax, 0xaff109
call fcn.00af8df7
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov esi, eax
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.00a9cf4b
test eax, eax
jns 0xb408cc
xor bl, bl
mov byte [ebp - 4], 3
test esi, esi
jne 0xa9cf42
mov dword [ebp - 4], 4
cmp dword [ebp - 0x10], 0
jne 0xb408fa
or dword [ebp - 4], 0xffffffff
mov al, bl
call fcn.00af8dc0
ret
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xa9cf25
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
call fcn.00aa25f0
mov esi, dword [ebp - 0x14]
test eax, eax
js 0xa9cf1b
push esi
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0xa9cf1d
jmp 0xa9cf1b
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xa9cf36
Function at 0xa9cf4b
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov ebx, edx
push eax
push 0x800
xor edx, edx
lea eax, [ebp - 0x2c]
push eax
push edx
mov dword [ebx], edx
mov dword [ebp - 8], edx
call dword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaOpenPolicy]
mov esi, eax
mov edi, 0x10000000
or esi, edi
jl 0xa9cfe0
and dword [ebp - 0xc], 0
lea eax, [ebp - 0x14]
and dword [ebp - 4], 0
push 0x9f3370
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push SysReAllocString
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaLookupNames2]
mov esi, eax
or esi, edi
jge 0xb40908
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaFreeMemory]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaFreeMemory]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 4]
cmp dword [eax], 7
je 0xb4097b
cmp dword [eax], 8
je 0xb4097b
push dword [eax + 4]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
mov esi, eax
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov edi, eax
test edi, edi
je 0xb40971
mov eax, dword [ebp - 4]
push dword [eax + 4]
push edi
push esi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
test eax, eax
je 0xb40947
mov dword [ebx], edi
xor edi, edi
xor esi, esi
jmp 0xb40965
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xb4095e
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xb40965
mov esi, 0x80004005
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xa9cfc5
mov esi, 0x8007000e
jmp 0xa9cfc5
mov esi, 0x80004005
jmp 0xa9cfc5
Function at 0xa9cfe7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov byte [ebp - 0xd], 0
test ebx, 0x3308
jne 0xa9d1d4
call fcn.00a9ce17
test al, al
je 0xa9d1d4
call fcn.00a9cea8
test al, al
jne 0xa9d1d4
call fcn.00a9cee5
test al, al
jne 0xa9d1d4
push 0xd
call dword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
test eax, eax
jne 0xa9d1d4
call fcn.00a9f4f0
test al, al
jne 0xa9d1d4
push esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x38]
xor esi, esi
push eax
push esi
push 0x20010010
push 0x9f1ee0
push 0x9f1e60
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp dword [ebp - 0x38], esi
jne 0xa9d1d3
call fcn.00a9dac0
test al, al
jne 0xa9d1d3
call fcn.00a9d1f0
test al, al
jne 0xa9d1d3
xor eax, eax
lea edx, [ebp - 0x24]
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
call fcn.00a9c1e7
test eax, eax
jns 0xa9d0c4
lea ecx, [ebp - 0x24]
call fcn.00b67649
jmp 0xa9d0de
mov ecx, dword [ebp - 0x24]
call fcn.00a9b86b
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.00ab02ed
test esi, esi
jne 0xa9d1d3
xor eax, eax
lea edx, [ebp - 0x30]
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
call fcn.00a9c1e7
test eax, eax
jns 0xa9d102
lea ecx, [ebp - 0x30]
call fcn.00b67649
jmp 0xa9d11c
mov ecx, dword [ebp - 0x30]
call fcn.00a9b892
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.00ab02ed
test esi, esi
jne 0xa9d1d3
call fcn.00ad1970
test eax, eax
jne 0xa9d1d3
call fcn.00c46880
test al, al
jne 0xa9d1d3
xor esi, esi
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00a9f258
test eax, eax
jns 0xa9d15a
push eax
push 0x9f6984
mov edx, 0x120d
jmp 0xa9d1cb
cmp dword [ebp - 0x14], 2
lea eax, [ebp - 0xc]
push 4
push eax
setle byte [ebp - 0xe]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.api_ms_win_core_localization_l1_2_3.dll_GetUserDefaultGeoName]
mov esi, 0x9f6984
test eax, eax
jne 0xa9d18b
mov ecx, dword [ebp + 4]
mov edx, 0x1212
push esi
call fcn.00b6203c
shr ebx, 2
and bl, 1
mov byte [ebp - 0xd], 1
mov byte [ebp - 0xf], bl
call fcn.00c1c523
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0xf]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00c1607d
call fcn.00c47fcd
test eax, eax
jns 0xa9d1d3
push eax
push esi
mov edx, 0x121f
mov ecx, dword [ebp + 4]
call fcn.00ab606d
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0xd]
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
Function at 0xa9d221
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [edi + 0xc], 0x9d4758
mov dword [edi + 0x10], 0x39
call fcn.00a9d826
mov ecx, edi
call fcn.00a9d2da
test dword [edi + 0x68], 0x802
jne 0xb40985
xor al, al
push ecx
push ecx
lea ecx, [edi + 0xdc]
mov byte [edi + 0x78], al
call fcn.00aeb5af
test eax, eax
js 0xb40999
push 0x9f13e0
push 0x9f05b0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegDeleteKeyValueW]
push 0
lea eax, [edi + 0xf4]
push eax
push 0xc15010
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolTimer]
mov ebx, eax
mov eax, dword [edi + 0x100]
mov dword [ebp - 4], eax
test eax, eax
jne 0xb409b1
mov dword [edi + 0x100], ebx
test ebx, ebx
je 0xb409cd
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
push 0
push 0
push eax
push ebx
mov dword [ebp - 0xc], 0xdc3cba00
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolTimer]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
test dword [edi + 0x68], 0x1200
jne 0xa9d255
mov al, 1
jmp 0xa9d257
mov ecx, dword [ebp + 4]
mov edx, 0x163e
push eax
push 0x9f6984
call fcn.00ab606d
jmp 0xa9d26f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push dword [ebp - 4]
mov esi, eax
call fcn.00a8f70d
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0xa9d2ab
mov ecx, dword [ebp + 4]
mov edx, 0x164d
push 0x9f6984
call fcn.00b5af13
jmp 0xa9d2d5
Function at 0xa9d620
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40000047
mov edi, ecx
xor esi, esi
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0xa9d763
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
jne 0xa9d763
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
inc ebx
push ebx
push esi
push 0x9f36c0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xa9d762
push edi
lea ecx, [ebp - 0x214]
call fcn.00a4bdea
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x1fe
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x9f36b4
push esi
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
jne 0xa9d711
cmp dword [ebp - 0x20c], ebx
jne 0xa9d711
test byte [0xc96fc1], 0x40
mov edi, 0x9f3638
je 0xa9d6e5
push edi
mov edx, 0x9efb68
call fcn.00a4d165
push dword [ebp - 0x214]
lea ecx, [ebp - 0x204]
push 7
pop edx
call fcn.00a9d777
test eax, eax
jne 0xa9d773
test byte [0xc96fc1], 0x40
je 0xa9d711
push edi
mov edx, 0x9efb58
call fcn.00a4d165
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x1fe
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x9f36ac
push 0
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
je 0xb40a18
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea ecx, [ebp - 0x214]
call fcn.00a4f6ba
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret
mov esi, ebx
jmp 0xa9d6fd
cmp dword [ebp - 0x20c], ebx
jne 0xa9d74b
test byte [0xc96fc1], 0x40
mov edi, 0xa27718
je 0xb40a3d
push edi
mov edx, 0x9efb68
call fcn.00a4d165
push dword [ebp - 0x214]
mov edx, ebx
lea ecx, [ebp - 0x204]
call fcn.00a9d777
test eax, eax
je 0xb40a56
mov esi, ebx
test byte [0xc96fc1], 0x40
je 0xa9d74b
push edi
mov edx, 0x9efb58
call fcn.00a4d165
jmp 0xa9d74b
Function at 0xa9d777
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0xc940a0]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 0x10], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x18], edx
push edi
mov ebx, eax
lea eax, [esp + 0x20]
push 0x104
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
je 0xa9d7ff
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jne 0xa9d7ff
movzx eax, word [esi]
mov ebx, esi
mov edx, eax
test ax, ax
jne 0xa9d818
test dx, dx
jne 0xa9d81f
xor edi, edi
inc edi
mov dword [esp + 0x10], edi
xor eax, eax
cmp word [esi], ax
jne 0xb40ac3
lea esi, [ebx + 2]
test edi, edi
je 0xa9d7d1
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x22c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00ab3c50
mov esp, ebp
pop ebp
ret 4
mov ecx, eax
jmp 0xb40a95
xor eax, eax
mov word [ebx], ax
jmp 0xa9d7e9
movzx edx, cx
cmp cx, 0x20
je 0xa9d7dd
movzx edx, cx
cmp cx, 0x2c
je 0xa9d7dd
add ebx, 2
movzx eax, word [ebx]
mov ecx, eax
mov edx, eax
test ax, ax
jne 0xb40a95
jmp 0xa9d7dd
test byte [0xc96fc1], 0x40
je 0xb40ade
mov ecx, esi
call fcn.00a4ca65
push eax
mov edx, 0x9efa98
call fcn.00a4d165
lea eax, [esp + 0xc]
xor edx, edx
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push ecx
push ecx
push dword [esp + 0x2c]
mov ecx, esi
push eax
call fcn.00a4c2c0
test eax, eax
jns 0xb40b54
push 0xa277ac
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
test byte [0xc96fc1], 0x40
mov edi, eax
je 0xb40b2a
mov ecx, esi
call fcn.00a4ca65
push eax
xor eax, eax
mov edx, 0x9efb18
push eax
call fcn.00a4d0d7
test edi, edi
je 0xb40b4b
push esi
push 0x1030
push 0x20c
push 0x203
xor eax, eax
push eax
push edi
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_ShellMessageBoxW]
add esp, 0x18
mov edi, dword [esp + 0x10]
jmp 0xa9d7f4
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
call fcn.00a4ca80
test byte [0xc96fc1], 0x40
je 0xb40b87
mov ecx, esi
call fcn.00a4ca65
push eax
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
push eax
mov edx, 0x9efb18
call fcn.00a4d0d7
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [esp + 0x18], 1
jmp 0xa9d7f4
Function at 0xa9dc5a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0xaff19a
call fcn.00af8df7
and dword [ebp - 0x14], 0
xor bl, bl
and dword [ebp - 4], 0
mov edi, dword [ebp - 0x14]
test edi, edi
jne 0xb40db2
and dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
call fcn.00a9eff6
mov ecx, dword [ebp + 4]
test eax, eax
js 0xb40dcd
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x20]
push dword [ebp - 0x14]
push 0x9f3a80
push 0x9f3a24
push eax
call fcn.00a9eb3b
mov ecx, dword [ebp + 4]
add esp, 0x10
test eax, eax
js 0xb40de2
mov byte [ebp - 4], 2
and dword [ebp - 0x10], 0
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x10]
test edi, edi
jne 0xb40df7
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [ebp - 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jg 0xb40e12
mov ecx, dword [ebp + 4]
test eax, eax
js 0xb40e1f
xor eax, eax
push eax
push eax
push eax
push eax
push 0x9f3928
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 4], 4
cmp dword [ebp - 0x10], 0
je 0xa9dd3b
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.00ab02ed
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0xa9dd5e
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov al, bl
call fcn.00af8dc0
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0xa9dc7b
push eax
push 0x9f6984
mov edx, 0x290
call fcn.00ab606d
jmp 0xa9dd4b
push eax
push 0x9f6984
mov edx, 0x293
call fcn.00ab606d
jmp 0xa9dd3f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0xa9dcdc
movzx eax, ax
or eax, 0x80070000
jmp 0xa9dd01
push eax
push 0x9f6984
mov edx, 0x296
call fcn.00ab606d
jmp 0xa9dd28
Function at 0xa9ed80
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0xaff26e
call fcn.00af8df7
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00ab02ed
or dword [ebp - 0x14], 0xffffffff
lea edx, [ebp - 0x18]
or dword [ebp - 0x10], 0xffffffff
call fcn.00a9eff6
test eax, eax
js 0xb41333
mov esi, dword [ebp - 0x18]
call fcn.00a9f201
test al, al
jne 0xa9ee0a
call fcn.00a9f15b
test al, al
jne 0xa9ee0a
mov ecx, esi
call fcn.00a9efae
test al, al
jne 0xa9ee0a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push 0x2008
push ebx
push 0xa9d4c0
mov dword [eax + 0x1a8], ecx
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
lea ecx, [ebp - 0x18]
call fcn.00ab02ed
mov al, bl
call fcn.00af8dc0
ret 8
mov bl, 1
jmp 0xa9edf8
mov ecx, dword [ebp + 4]
mov edx, 0xe7d
push eax
push 0x9f9bd4
call fcn.00ab606d
jmp 0xa9edba
Function at 0xa9f187
Capabilities:
Get session user name

Disassembly:
push 0x43c
mov eax, 0xaff2cc
call fcn.00af8e2b
call fcn.00a9f22d
test eax, eax
je 0xa9f1f9
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
mov ebx, 0x9f3d98
push eax
push 2
push 0x9f3e60
mov edx, ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00aac1c5
xor edi, edi
test eax, eax
jns 0xb41474
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], edi
push eax
push ecx
push 0x9f3e34
mov edx, ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00a41860
cmp dword [ebp - 0x444], 0
jne 0xb41572
xor eax, eax
call fcn.00af8dd5
ret
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], 0x111
push eax
lea eax, [ebp - 0x438]
push eax
push 2
call dword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
je 0xa9f1cd
push 0x5c
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrChrW]
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x210]
add eax, 2
push ecx
push 0xffffffffffffffff
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
je 0xa9f1cd
mov dword [ebp - 0x43c], edi
lea ecx, [ebp - 0x43c]
mov dword [ebp - 4], edi
call fcn.00a398c6
lea eax, [ebp - 0x43c]
mov edx, 0xa27088
push eax
mov ecx, 0xa27098
call fcn.00c1a9f7
mov esi, eax
test esi, esi
jns 0xb41502
mov edx, 0x798
jmp 0xb41523
mov eax, dword [ebp - 0x43c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
jns 0xb4155e
mov edx, 0x799
mov ecx, dword [ebp + 4]
push esi
push 0x9f6984
call fcn.00aa4c55
lea ecx, [ebp - 0x43c]
jmp 0xb41552
mov edx, 0x7a5
mov ecx, dword [ebp + 4]
push esi
push 0x9f6984
call fcn.00aa4c55
lea ecx, [ebp - 0x440]
call fcn.00a398c6
mov eax, esi
jmp 0xa9f1fb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.00a398c6
jmp 0xa9f1cd
call fcn.00ab5b55
test al, al
je 0xa9f1f9
mov dword [ebp - 0x440], edi
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 1
call fcn.00a398c6
lea eax, [ebp - 0x440]
mov edx, 0xa27088
push eax
mov ecx, 0xa27098
call fcn.00c1a9f7
mov esi, eax
test esi, esi
jns 0xb415ba
mov edx, 0x7a4
jmp 0xb4153e
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, eax
test esi, esi
js 0xb41539
lea ecx, [ebp - 0x440]
call fcn.00a398c6
jmp 0xa9f1f9
Function at 0xa9f2ff
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
mov dword [ebx], 2
test edi, edi
je 0xa9f31d
mov dword [edi], esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x10
push edx
push 0x9f3e90
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb4162a
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
ja 0xa9f352
mov dword [ebx], esi
test edi, edi
je 0xa9f358
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
cmp eax, 2
jne 0xb4163a
mov dword [ebx], 1
jmp 0xa9f358
test eax, eax
jg 0xb41645
mov esi, eax
jmp 0xa9f358
movzx esi, ax
or esi, 0xc0070000
jmp 0xa9f358

Function at 0xa9f593
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
push edi
mov edi, edx
test ecx, ecx
je 0xb41692
push esi
test edi, edi
je 0xa9f608
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xa9f5d7
mov esi, ebx
push ebx
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 4
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0xa9f5c5
cmp dword [ebp + 8], ebx
je 0xa9f60d
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
test edi, edi
je 0xa9f5c7
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xa9f5c7
mov dword [ebp - 4], ecx
jmp 0xa9f5de
xor esi, esi
inc esi
jmp 0xa9f5fb
push 0x57
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0xa9f5d1
Function at 0xa9f808
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push ebx
push 0x10
push 0x9f4264
push ebx
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xa9f847
mov eax, dword [ebp - 8]
cmp eax, 0x418937
jae 0xa9f847
mov dword [esi + 0x1c], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0x9f423c
push ebx
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xa9f87d
mov eax, dword [ebp - 8]
cmp eax, 0x4000
jne 0xb418a5
mov dword [esi + 0x30], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0x9f421c
push ebx
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xa9f8ad
mov eax, dword [ebp - 8]
cmp eax, 2
ja 0xa9f8ad
mov dword [esi + 0x34], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x10
push 0x9f41f8
push ebx
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xa9f8e2
mov eax, dword [ebp - 8]
cmp eax, 8
jae 0xa9f8e2
cmp eax, 5
ja 0xa9f8e2
mov dword [esi + 0x38], eax
pop esi
pop ebx
leave
ret 4
cmp eax, 0x20
je 0xa9f87a
cmp eax, 0x40
jne 0xa9f87d
jmp 0xa9f87a

Function at 0xa9f92b
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x9f05b0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xa9f964
push 0x9f408c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
leave
ret