joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7593e902
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x7594d0ac]
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0x12
pop ecx
mov dword [ebp - 4], eax
xor ebx, ebx
mov byte [ebp - 0x50], bl
xor eax, eax
lea edi, [ebp - 0x4f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
push 0x759344d0
mov edi, 0x759344e8
push edi
push edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], ebx
call fcn.7593e68d
test eax, eax
jne 0x7593e953
mov dword [ebp - 0x74], 1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp ecx, dword [eax + 0x1d4]
je 0x7593e993
push ebx
push 0x75934590
push edi
push dword [ebp - 0x78]
call fcn.7593e68d
test eax, eax
jne 0x7593e993
call fcn.7592651f
test eax, eax
je 0x7593e98f
call fcn.75926534
test eax, eax
je 0x7593e993
or byte [ebp - 0x74], 0x80
push 0x13
push esi
call fcn.759403b6
test eax, eax
je 0x7593eab0
mov esi, dword [sym.imp.ntdll.dll_NtPowerInformation]
or dword [ebp - 0x74], 6
push 0x4c
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push 4
pop edi
push edi
call esi
cmp byte [ebp - 0x49], bl
jne 0x7593e9d1
push ebx
push 0x75934778
push 0x75922808
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
cmp byte [ebp - 0x4a], bl
je 0x7593e9df
cmp byte [ebp - 0x48], bl
je 0x7593e9df
or dword [ebp - 0x74], 0x40
cmp byte [ebp - 0x4d], bl
jne 0x7593e9ee
cmp byte [ebp - 0x4c], bl
jne 0x7593e9ee
cmp byte [ebp - 0x4b], bl
je 0x7593ea4e
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
push 0x7593eb00
push 0x80000002
mov dword [ebp - 0x80], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7593ea3f
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push 0x7593eaec
push dword [ebp - 0x7c]
mov dword [ebp - 0x84], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80], ebx
je 0x7593ea4a
or dword [ebp - 0x74], 0x30
jmp 0x7593ea4e
or dword [ebp - 0x74], 0x10
push ebx
push 0x7593eac4
push 0x75934618
push dword [ebp - 0x78]
call fcn.7593e68d
test eax, eax
jne 0x7593eab0
push 0x20
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push 5
call esi
test eax, eax
jne 0x7593eab0
cmp byte [ebp - 0x70], bl
je 0x7593eab0
push 0x75934760
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x7593eab0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x7593eaa9
lea ecx, [ebp - 0x78]
push ecx
mov dword [ebp - 0x78], ebx
call eax
cmp dword [ebp - 0x78], ebx
je 0x7593eaa9
or byte [ebp - 0x73], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
pop ebx
call fcn.75921930
leave
ret 0xc
Function at 0x7593f5fa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x7594d0ac]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x134], eax
xor ebx, ebx
mov dword [ebp - 0x124], ebx
xor eax, eax
lea edi, [ebp - 0x120]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x1000
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], ebx
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push ebx
mov esi, 0x80000001
push esi
call fcn.7593e902
mov edi, eax
mov eax, dword [ebp + 0x10]
not eax
and edi, eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
push 1
call fcn.7592d225
lea eax, [ebp - 0x124]
push eax
call fcn.7592cdc0
push dword [ebp - 0x128]
lea eax, [ebp - 0x124]
push dword [ebp - 0x12c]
push eax
call fcn.7592cf7f
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
push edi
push esi
call fcn.7593e761
push ebx
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push 0x75923bf8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7593f716
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push 0x75923bd8
push dword [ebp - 0x114]
mov dword [ebp - 0x10c], 0xfe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7593f704
mov word [ebp - 0x104], bx
push dword [ebp - 0x114]
mov word [ebp - 8], bx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7593f71d
mov word [ebp - 0x104], bx
cmp dword [ebp - 0x108], ebx
jne 0x7593f72f
mov dword [ebp - 0x108], 2
push 0x1000
mov dword [ebp - 0x10c], 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x7593f752
mov dword [ebp - 0x10c], 6
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x110]
lea eax, [ebp - 0x104]
push ebx
push ebx
push dword [ebp - 0x10c]
push eax
push dword [ebp - 0x108]
push edi
push dword [ebp - 0x134]
call fcn.7593f0a6
mov edi, eax
cmp edi, ebx
je 0x7593f792
push 0xff
push edi
push esi
call fcn.7593e845
cmp edi, 0x100
jne 0x7593f79d
push 2
pop edi
mov eax, dword [0x7594d158]
cmp eax, ebx
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
je 0x7593f7af
push eax
call esi
mov eax, dword [0x7594d170]
cmp eax, ebx
je 0x7593f7bb
push eax
call esi
mov eax, dword [0x7594d184]
cmp eax, ebx
je 0x7593f7c7
push eax
call esi
jmp 0x75a3e668
Function at 0x75940325
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 8
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
jge 0x7594034a
xor eax, eax
jmp 0x759403ad
cmp dword [ebp - 0xc], 1
jne 0x75940390
lea eax, [ebp - 8]
push eax
push 2
push 2
push 0
push 0x2000c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x759403a6
lea eax, [ebp - 4]
push eax
push dword [0x7594d098]
push dword [ebp - 8]
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x75940385
and dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x759403aa
lea eax, [ebp - 4]
push eax
push dword [0x7594d098]
push dword [ebp + 8]
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x759403aa
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x75941edf
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
xor edi, edi
push 1
push edi
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x200
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x75942013
push 5
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x7594200a
push ebx
push esi
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call esi
mov ebx, eax
cmp ebx, edi
je 0x75941fff
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call edi
test eax, eax
jne 0x75941f88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x75941ff8
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
push 0x40
call esi
mov ebx, eax
test ebx, ebx
je 0x75941fff
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x75941ff8
cmp dword [ebx + 4], 2
jne 0x75941ff8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xc], eax
mov edi, 0x1f4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
ja 0x75941ff8
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x75941ff8
mov eax, dword [ebp - 0x28]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x75941fd6
cmp dword [ebp - 0x20], 0x435
je 0x75941fea
jmp 0x75941ff8
cmp eax, 4
je 0x75941fef
cmp eax, 5
je 0x75941fef
cmp eax, 6
je 0x75941fef
cmp eax, 7
je 0x75941fef
push edi
call esi
jmp 0x75941ff2
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x75941fa2
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x75a3a0e0
Function at 0x759420b5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x7594d0ac]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x21c]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x759422a8
mov edi, 0x80000002
push edi
mov dword [ebp - 0x218], 0x63
call esi
test eax, eax
jne 0x75942152
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0x7594228c
push dword [ebp - 0x21c]
mov dword [ebp - 0x214], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x228], 1
jne 0x75942152
xor eax, eax
jmp 0x7594224e
cmp dword [ebp - 0x220], 0
je 0x75942248
push 0x7592a898
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call fcn.75942020
push dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x210]
push eax
push ebx
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
test eax, eax
jne 0x759421e0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0x7594226c
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x75942260
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push eax
push ebx
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
test eax, eax
jne 0x75942248
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0x7594226c
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.75921930
leave
ret 4

Function at 0x759426d0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x70], ebx
jne 0x75942733
push edi
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [esi + 0x70], eax
je 0x75942707
push edi
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x75942738
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esi + 0x10]
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x1e
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
ret
Function at 0x7594277f
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
jmp fcn.759426d0

Function at 0x759440b0
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x759440f4
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.7592505d
lea ecx, [ebp - 0x1c]
call fcn.75945ab0
cmp dword [ebp + 8], ebx
je 0x759440ec
cmp eax, ebx
je 0x759440ec
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x759440ec
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.759255a9
mov al, bl
pop ebx
leave
ret 8

Function at 0x75944bcc
Capabilities:
Check for time delay via gettickcount
Create pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x7594d0ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp dword [0x7594d2a0], esi
push edi
mov dword [ebp - 0x21c], eax
je 0x75944c7c
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.75944a61
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push esi
push esi
push esi
push 1
push esi
push 0x40080002
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ebx, eax
cmp ebx, esi
jne 0x75944c57
call edi
add dword [ebp - 0x214], eax
call fcn.7592dd98
jmp 0x75944c59
xor eax, eax
cmp eax, esi
jge 0x75944c6e
inc dword [ebp - 0x210]
cmp dword [ebp - 0x210], 5
jg 0x75944c83
jmp 0x75944c12
lea eax, [ebp - 0x20c]
push eax
call fcn.759449be
jmp 0x75944c83
xor ebx, ebx
mov eax, 0xc0000022
mov ecx, dword [ebp - 0x21c]
pop edi
mov dword [ecx], ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.75921930
leave
ret 8

Function at 0x75945530
Capabilities:
Terminate process

Disassembly:
push 0
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x75a41098
Function at 0x759457e5
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x500
mov eax, dword [0x7594d0ac]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x4fc], esi
mov byte [ebp - 0x4e5], 0
je 0x75945819
cmp word [ebx], di
jne 0x7594583b
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x4ec], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x7594583b
lea ebx, [ebp - 0x24]
cmp esi, edi
je 0x75945921
cmp ebx, edi
je 0x75945921
push edi
call sub.WINSTA.dll_WinStationOpenServerW
cmp eax, edi
mov dword [ebp - 0x4ec], eax
je 0x75945921
lea ecx, [ebp - 0x4f8]
push ecx
lea ecx, [ebp - 0x4f4]
push ecx
push eax
call sub.WINSTA.dll_WinStationEnumerateW
test al, al
je 0x75945916
mov esi, dword [ebp - 0x4f4]
mov dword [ebp - 0x4f0], edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
add esi, 0x48
mov eax, dword [ebp - 0x4f0]
cmp eax, dword [ebp - 0x4f8]
jae 0x7594590b
mov eax, dword [esi]
test eax, eax
je 0x759458a9
cmp eax, 4
jne 0x759458f9
lea eax, [ebp - 0x500]
push eax
push 0x4c0
lea eax, [ebp - 0x4e4]
push eax
push 8
push dword [esi - 0x48]
push dword [ebp - 0x4ec]
call sub.WINSTA.dll_WinStationQueryInformationW
test al, al
je 0x759458f9
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x4fc]
call edi
test eax, eax
jne 0x759458f2
lea eax, [ebp - 0x80]
push eax
push ebx
call edi
test eax, eax
mov byte [ebp - 0x4e5], 1
je 0x759458f9
mov byte [ebp - 0x4e5], 0
inc dword [ebp - 0x4f0]
add esi, 0x4c
cmp byte [ebp - 0x4e5], 0
je 0x75945890
push dword [ebp - 0x4f4]
call sub.WINSTA.dll_WinStationFreeMemory
push dword [ebp - 0x4ec]
call sub.WINSTA.dll_WinStationCloseServer
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x4e5]
pop edi
pop esi
pop ebx
call fcn.75921930
leave
ret 8

Function at 0x75945b67
Capabilities:
Impersonate user

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push esi
push 0
push 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x75945b9e
and dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x773
je 0x75945b9e
cmp eax, 0x532
jne 0x75945ba0
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x75945baa
Capabilities:
Get token privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push ebx
mov esi, ecx
push 3
push dword [esi]
mov dword [ebp - 4], ebx
call edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x75945c03
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 3
push dword [esi]
call edi
test eax, eax
jne 0x75945c03
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x75945c00
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 0xc], ebx
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7594629a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [ebp + 0x14]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov byte [ebp + 0x17], al
lea eax, [ebp - 8]
push eax
xor ebx, ebx
mov edi, 0x20019
push edi
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push 0x80000002
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], bl
call esi
test eax, eax
jne 0x75946312
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0xc], 4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x75946304
cmp dword [ebp - 0x10], ebx
mov byte [ebp - 1], 1
setne byte [ebp + 0x17]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
jne 0x75946358
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x75946358
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0xc], 4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7594634f
cmp dword [ebp - 0x10], ebx
setne byte [ebp + 0x17]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp + 0x17]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x759470ec
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x7594d0ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sub eax, 0x4e87
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x20c], ebx
je 0x7594719a
dec eax
je 0x75947137
dec eax
je 0x75947128
dec eax
je 0x75947176
jmp 0x759472e0
mov dword [ebp - 0x208], 0x4ea4
jmp 0x759471bd
cmp byte [esi + 0x87], 0
je 0x7594714c
mov dword [ebp - 0x208], 0x4ea2
jmp 0x759471bd
mov eax, dword [esi + 0x6c]
cmp eax, 0x10
je 0x75947182
cmp eax, 0x40
jmp 0x75a35450
mov dword [ebp - 0x208], 0x4ea5
jmp 0x759471bd
xor eax, eax
cmp byte [esi + 0x86], al
setne al
add eax, 0x4ea2
mov dword [ebp - 0x208], eax
jmp 0x759471bd
xor eax, eax
cmp dword [esi + 0x70], 0x100
setne al
dec eax
and eax, 0xffffb4b3
add eax, 0x4ea1
mov dword [ebp - 0x208], eax
je 0x759472e0
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x210], eax
je 0x759472df
push edi
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x759472d3
push 0x14
call fcn.7592becf
test eax, eax
je 0x75947214
push ebx
push dword [esi]
mov ecx, eax
call fcn.75948c27
jmp 0x75947216
xor eax, eax
test eax, eax
mov dword [esi + 0x8c], eax
je 0x759472d3
cmp dword [ebp - 0x208], 0x354
jne 0x7594724f
mov eax, dword [esi + 0x90]
test eax, eax
je 0x7594724f
push 0xfe
push eax
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x75947269
push 0xfe
lea eax, [ebp - 0x200]
push eax
push dword [ebp - 0x208]
push dword [esi]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
setne al
test al, al
je 0x759472d3
push dword [ebp - 0x210]
mov ecx, esi
call fcn.7594626a
mov ecx, dword [esi + 0x8c]
mov eax, 0x80000000
push eax
push eax
mov word [ebp - 0x204], 0xd
mov word [ebp - 0x202], 0xa
call fcn.75948d51
push dword [ebp - 0x210]
mov ecx, dword [esi + 0x8c]
push 0
call fcn.75948db4
mov ecx, dword [esi + 0x8c]
lea eax, [ebp - 0x204]
push eax
call fcn.75948dd6
mov ecx, dword [esi + 0x8c]
call fcn.75948e1a
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.75921930
leave
ret 8
Function at 0x75947a68
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x84], 0
push edi
je 0x75947ad5
mov eax, dword [ebp + 8]
test eax, eax
jne 0x75947aaf
push 0x40
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x75947a9c
push dword [esi]
mov ecx, eax
call fcn.759486d7
mov edi, eax
jmp 0x75947a9e
xor edi, edi
test edi, edi
je 0x75947aab
mov ecx, edi
call fcn.759483fa
jmp 0x75947ab1
xor eax, eax
jmp 0x75947ab1
xor edi, edi
push esi
push 0x7594799f
push eax
push 0x4e84
push dword [esi]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor esi, esi
cmp edi, esi
mov ebx, eax
je 0x75947ad9
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x75947ad9
xor ebx, ebx
xor esi, esi
push esi
lea eax, [ebp + 8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x759346f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov esi, 0x100
jne 0x75947b29
cmp ebx, esi
sete al
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x759346c8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
jne 0x75947b30
push 2
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x75947c79
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x75947cae
mov ecx, esi
mov byte [esi + 0x10], 1
call fcn.75922668
mov eax, dword [esi + 0xc]
test eax, eax
je 0x75947caa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0xc], 0
xor eax, eax
pop esi
ret
pop esi
jmp fcn.7592dd98

Function at 0x75948b90
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x7594d0ac]
mov dword [ebp - 4], eax
mov eax, dword [0x7594e2b8]
cmp eax, 0xffffffff
push esi
mov esi, dword [ebp + 8]
jne 0x75948c03
and dword [0x7594e2b8], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test ax, ax
mov word [0x7594f280], ax
je 0x75948bfe
push 0x10
lea ecx, [ebp - 0x24]
push ecx
movzx eax, ax
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x75948bfe
test byte [ebp - 0x15], 8
je 0x75948bfe
xor eax, eax
mov ax, word [0x7594f280]
push eax
call fcn.75948b5c
test eax, eax
je 0x75948bfe
mov dword [0x7594e2b8], 1
mov eax, dword [0x7594e2b8]
test eax, eax
je 0x75948c15
test esi, esi
je 0x75948c15
mov cx, word [0x7594f280]
mov word [esi], cx
mov ecx, dword [ebp - 4]
pop esi
call fcn.75921930
leave
ret 4