joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75e36120
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x75ea0720]
jne 0x75e97f11
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
push edi
mov dword [0x75ea0838], eax
mov dword [0x75ea0834], ecx
mov dword [0x75ea0830], edx
mov dword [0x75ea082c], ebx
mov dword [0x75ea0828], esi
mov dword [0x75ea0824], edi
mov word [0x75ea0850], ss
mov word [0x75ea0844], cs
mov word [0x75ea0820], ds
mov word [0x75ea081c], es
mov word [0x75ea0818], fs
mov word [0x75ea0814], gs
pushfd
pop dword [0x75ea0848]
mov eax, dword [ebp + 4]
lea ecx, [ebp + 4]
add ecx, 4
mov dword [0x75ea084c], ecx
mov dword [0x75ea0840], eax
mov dword [0x75ea0788], 0x10001
lea ecx, [ebp + 4]
mov ecx, dword [ecx - 4]
mov dword [0x75ea0744], eax
mov eax, dword [0x75ea0720]
xor edi, edi
mov dword [0x75ea083c], ecx
mov dword [0x75ea0738], 0xc0000409
inc edi
mov dword [0x75ea073c], edi
mov dword [ebp - 4], eax
mov eax, dword [0x75ea0070]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x75e97fec
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
push 0xc0000409
mov dword [ebp - 0x320], edi
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
pop edi
leave
ret
Function at 0x75e3c2ba
Capabilities:
Link many functions at runtime

Disassembly:
mov dword [0x75ea00a8], 1
jmp fcn.75e3c2cb
Function at 0x75e4c540
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call esi
and dword [ebp - 0x28], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20019
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x20], 0x40
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, eax
test esi, esi
jl 0x75e70e7d
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
add eax, 0xc
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 2
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jl 0x75e70e7d
mov eax, dword [ebp - 4]
pop esi
leave
ret 0x10
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x75e4c5d2

Function at 0x75e51be8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [0x75ea00a0]
jne 0x75e51c3c
push dword [ebp + 8]
push dword [0x75ea00a4]
call dword [sym.imp.kernel32.dll_IsDBCSLeadByteEx]
test eax, eax
jne 0x75e51c65
push 1
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp + 8]
push eax
push 0
push dword [0x75ea00a4]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x75e51c65
push 1
push esi
push dword [ebp - 4]
call fcn.75e5f345
cwde
pop esi
leave
ret 8
push 2
lea eax, [ebp + 0xc]
push eax
movzx eax, si
push 0x20001004
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x75e51c65
mov eax, dword [ebp + 0xc]
mov dword [0x75ea00a4], eax
mov dword [0x75ea00a0], esi
jmp 0x75e51bfa
or eax, 0xffffffff
jmp 0x75e51c37
Function at 0x75e74988
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
inc esi
push esi
push 0x75e7476c
lea eax, [ebp - 0xc]
push 4
push eax
call sub.ntdll.dll_swprintf_s
add esp, 0x10
push 0x75e74744
push 9
lea eax, [ebp - 0x20]
push eax
push 0x75e47cd4
lea eax, [ebp - 0xc]
push eax
push 0x75e74734
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp eax, 0xffffffff
je 0x75e74a0f
cmp word [ebp - 0x20], 0
je 0x75e74a0f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x24]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
push dword [ebp + 8]
push dword [ebp - 0x24]
call fcn.75e74935
inc esi
cmp esi, 0x3e8
jb 0x75e7499e
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.75e36120
leave
ret 4

Function at 0x75e74a23
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x30]
push eax
push 0x20
lea eax, [ebp - 0x24]
push eax
push 2
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
pop esi
test eax, eax
jl 0x75e74a94
cmp dword [ebp - 0x1c], 3
jbe 0x75e74a94
movzx ax, byte [ebp - 0x15]
movzx ecx, byte [ebp - 0x16]
shl ax, 8
movzx eax, ax
or eax, ecx
movzx cx, byte [ebp - 0x17]
shl cx, 8
movzx ecx, cx
shl eax, 0x10
or eax, ecx
movzx ecx, byte [ebp - 0x18]
or eax, ecx
jmp 0x75e74a96
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.75e36120
leave
ret 8
Function at 0x75e74c71
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
xor esi, esi
mov dword [ebp - 0x90], eax
cmp dword [ebp + 0x18], esi
je 0x75e74d02
push 0x75e746a0
lea eax, [ebp - 0x80]
push 0x2e
push eax
call sub.ntdll.dll_wcscpy_s
push 0x75e3bc20
lea eax, [ebp - 0x80]
push 0x2e
push eax
call sub.ntdll.dll_wcscat_s
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.75e74b03
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x80]
push 0x2e
push eax
call sub.ntdll.dll_wcscat_s
add esp, 0xc
push esi
push esi
lea eax, [ebp - 0x80]
push eax
push 0x80000001
call dword [sym.imp.kernel32.dll_RegDeleteKeyExW]
cmp eax, esi
je 0x75e74cfa
push eax
call fcn.75e43a4f
xor eax, eax
jmp 0x75e74e78
xor eax, eax
inc eax
jmp 0x75e74e78
push ebx
mov ebx, dword [sym.imp.kernel32.dll_RegCreateKeyExW]
push edi
mov edi, dword [sym.imp.kernel32.dll_RegCloseKey]
mov dword [ebp - 0x8c], 0x80000001
mov dword [ebp - 0x94], esi
cmp dword [0x75e74e88], esi
je 0x75e74d85
mov eax, 0x75e74e88
push esi
lea ecx, [ebp - 0x84]
push ecx
push esi
push 0x2001f
push esi
push esi
push esi
push dword [eax]
push dword [ebp - 0x8c]
call ebx
push dword [ebp - 0x8c]
mov dword [ebp - 0x88], eax
call edi
cmp dword [ebp - 0x88], esi
jne 0x75e74e24
mov eax, dword [ebp - 0x84]
inc dword [ebp - 0x94]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x94]
lea eax, [eax*4 + 0x75e74e88]
cmp dword [eax], esi
jne 0x75e74d2d
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.75e74b03
push esi
lea eax, [ebp - 0x84]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x8c]
call ebx
push dword [ebp - 0x8c]
mov ebx, eax
call edi
cmp ebx, esi
jne 0x75e74e69
mov ebx, dword [sym.imp.kernel32.dll_RegSetValueExW]
push 4
lea eax, [ebp + 0x10]
push eax
push 3
push esi
push 0x75e746e8
push dword [ebp - 0x84]
call ebx
mov dword [ebp - 0x88], eax
cmp eax, esi
jne 0x75e74e06
push 4
lea eax, [ebp + 0xc]
push eax
push 3
push esi
push 0x75e74700
push dword [ebp - 0x84]
call ebx
mov dword [ebp - 0x88], eax
cmp eax, esi
je 0x75e74e2c
push dword [ebp - 0x84]
call edi
push 1
push dword [ebp - 0x90]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.75e74c71
push dword [ebp - 0x88]
jmp 0x75e74e6a
push 4
lea eax, [ebp - 0x90]
push eax
push 3
push esi
push 0x75e7471c
push dword [ebp - 0x84]
call ebx
push dword [ebp - 0x84]
mov ebx, eax
call edi
cmp ebx, esi
je 0x75e74e73
push 1
push dword [ebp - 0x90]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.75e74c71
push ebx
call fcn.75e43a4f
xor eax, eax
jmp 0x75e74e76
xor eax, eax
inc eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.75e36120
leave
ret 0x14
Function at 0x75e74e9d
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x48]
push eax
xor edi, edi
push 0x2000000
mov dword [ebp - 0x44], edi
call dword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
test eax, eax
jge 0x75e74ed7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.75e36120
leave
ret
push esi
push 0x75e746a0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 0x20019
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jge 0x75e74f2e
push dword [ebp - 0x48]
call esi
mov eax, edi
pop esi
jmp 0x75e74eca
push ebx
xor ebx, ebx
lea eax, [ebp - 0x64]
push eax
push 0x38
lea eax, [ebp - 0x3c]
push eax
push edi
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
cmp eax, edi
jl 0x75e74f63
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push eax
call fcn.75e74bb2
test eax, eax
je 0x75e74f6a
mov dword [ebp - 0x44], 1
jmp 0x75e74f6a
cmp eax, 0x8000001a
je 0x75e74f6d
inc ebx
jmp 0x75e74f31
push dword [ebp - 0x40]
call esi
mov edi, dword [ebp - 0x44]
pop ebx
jmp 0x75e74f24

Function at 0x75e7903e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push 8
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x75e7907a
push 0xa
lea eax, [ebp - 0x14]
push 0
push eax
call sub.ntdll.dll_wcstol
add esp, 0xc
jmp 0x75e79093
cmp esi, 0xb
je 0x75e79090
sub esi, 0x1004
neg esi
sbb esi, esi
and esi, 2
mov eax, esi
jmp 0x75e79093
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.75e36120
leave
ret 8
Function at 0x75e792b2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
push edi
push dword [ebp + 0x18]
lea eax, [ebp + 0x18]
push 2
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.USER32.dll_ToUnicodeEx
mov ebx, eax
mov esi, ebx
test ebx, ebx
jge 0x75e792df
neg esi
test esi, esi
je 0x75e79338
cmp edi, dword [0x75ea0ef4]
je 0x75e79316
push 2
lea eax, [ebp + 0x1c]
push eax
movzx eax, di
push 0x20001004
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
jne 0x75e79308
xor eax, eax
jmp 0x75e79340
mov eax, dword [ebp + 0x1c]
mov dword [0x75ea0ef0], eax
mov dword [0x75ea0ef4], edi
lea eax, [ebp + 0x10]
push eax
push 0
push 2
push dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push esi
push eax
push 0
push dword [0x75ea0ef0]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
je 0x75e79304
test ebx, ebx
jge 0x75e7933e
neg esi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x75e79d83
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub esp, 0xc
cmp dword [eax + 0x1d4], 0
je 0x75e79df0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp dword [eax + 0x1d4], ecx
je 0x75e79df0
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.75e79cb1
test eax, eax
je 0x75e79dec
mov eax, dword [ebp + 8]
sub eax, 0
je 0x75e79de7
dec eax
je 0x75e79dd6
dec eax
jne 0x75e79dec
mov eax, dword [ebp - 4]
jmp 0x75e79dfa
cmp dword [ebp - 0xc], 7
jne 0x75e79de2
movzx eax, word [ebp - 8]
jmp 0x75e79dfa
mov eax, dword [ebp - 8]
jmp 0x75e79dfa
mov eax, dword [ebp - 0xc]
jmp 0x75e79dfa
xor eax, eax
jmp 0x75e79dfa
push 0x2c
push dword [ebp + 8]
call fcn.75e360d5
leave
ret 4
Function at 0x75e7ae04
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c8
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
mov dword [ebp - 0x3bc], eax
push 0x75e74820
lea eax, [ebp - 0x3b8]
xor edi, edi
push eax
mov dword [ebp - 0x38c], edi
call esi
lea eax, [ebp - 0x3b8]
mov dword [ebp - 0x3a0], eax
lea eax, [ebp - 0x3a8]
push eax
push 0x20019
lea eax, [ebp - 0x37c]
push eax
mov dword [ebp - 0x3a8], 0x18
mov dword [ebp - 0x3a4], edi
mov dword [ebp - 0x39c], 0x40
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x394], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x75e7b061
lea eax, [ebp - 0x3ac]
push eax
push 0x2a
lea eax, [ebp - 0x30]
push eax
push edi
push edi
push dword [ebp - 0x37c]
mov dword [ebp - 0x378], edi
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
jl 0x75e7b045
push ebx
mov ebx, 0x134
lea eax, [ebp - 0x20]
mov dword [ebp - 0x384], eax
mov ax, word [ebp - 0x24]
mov word [ebp - 0x388], ax
mov word [ebp - 0x386], ax
lea eax, [ebp - 0x380]
push eax
push 0x10
lea eax, [ebp - 0x388]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
mov eax, dword [ebp - 0x380]
shr eax, 0x10
and eax, 0xf000
mov ecx, 0xe000
cmp ax, cx
jne 0x75e7b00b
push 0x75e74820
push ebx
lea eax, [ebp - 0x164]
push eax
call fcn.75e7a861
movzx eax, word [ebp - 0x388]
push eax
push dword [ebp - 0x384]
lea eax, [ebp - 0x164]
push ebx
push eax
call fcn.75e7adae
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x3b8]
push eax
call esi
lea eax, [ebp - 0x3b8]
mov dword [ebp - 0x3a0], eax
lea eax, [ebp - 0x3a8]
push eax
push 0x20019
lea eax, [ebp - 0x390]
push eax
mov dword [ebp - 0x3a8], 0x18
mov dword [ebp - 0x3a4], edi
mov dword [ebp - 0x39c], 0x40
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x394], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x75e7b00b
push 0x75e7b078
lea eax, [ebp - 0x3c8]
push eax
call esi
lea eax, [ebp - 0x3c0]
push eax
push 0x210
lea eax, [ebp - 0x374]
push eax
push 2
lea eax, [ebp - 0x3c8]
push eax
push dword [ebp - 0x390]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [ebp - 0x390]
mov dword [ebp - 0x3b0], eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x3b0], edi
jl 0x75e7b00b
push dword [ebp - 0x3bc]
xor eax, eax
mov word [ebp - 0x16a], ax
lea eax, [ebp - 0x368]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
je 0x75e7b03a
inc dword [ebp - 0x378]
lea eax, [ebp - 0x3ac]
push eax
push 0x2a
lea eax, [ebp - 0x30]
push eax
push edi
push dword [ebp - 0x378]
push dword [ebp - 0x37c]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
jl 0x75e7b044
jmp 0x75e7aec2
mov dword [ebp - 0x38c], 1
pop ebx
push dword [ebp - 0x37c]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x38c], edi
je 0x75e7b061
mov eax, dword [ebp - 0x380]
jmp 0x75e7b063
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.75e36120
leave
ret 4
Function at 0x75e7b08f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [eax + 0x1d4], ebx
je 0x75e7b1c1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
cmp dword [eax + 0x1d4], ecx
je 0x75e7b1c1
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x75e7b240
lea eax, [ebp - 0x74]
push eax
call esi
lea eax, [ebp - 0x74]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x8c]
push eax
push 0x20019
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x8c], 0x18
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x80], 0x40
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov edi, dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jl 0x75e7b173
push 0x75e7b2d8
lea eax, [ebp - 0x74]
push eax
call esi
lea eax, [ebp - 0x90]
push eax
push 0x14
lea eax, [ebp - 0x5c]
push eax
push 2
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [ebp - 0x64]
mov esi, eax
call edi
cmp esi, ebx
jl 0x75e7b173
cmp dword [ebp - 0x50], ebx
jne 0x75e7b1c1
call fcn.75e797cc
mov esi, eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x6c]
call fcn.75e79834
mov ebx, eax
mov eax, dword [0x75ea0138]
test byte [eax], 4
je 0x75e7b224
and dword [ebp - 0x60], 0
lea eax, [ebp - 0x60]
push eax
push 0x2000000
call dword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
test eax, eax
jl 0x75e7b1c1
push dword [ebp - 0x60]
push 0
call dword [0x75ea0228]
test ebx, ebx
jne 0x75e7b1d4
push dword [ebp - 0x60]
call edi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.75e36120
leave
ret 8
mov eax, esi
shr eax, 0x10
and eax, 0xf000
mov ecx, 0xe000
cmp ax, cx
jne 0x75e7b21f
lea eax, [ebp - 0x48]
push eax
call fcn.75e7ae04
test eax, eax
je 0x75e7b1f9
mov esi, eax
jmp 0x75e7b21f
mov eax, esi
and eax, 0xff0000
cmp eax, 0x200000
jae 0x75e7b21f
push dword [ebp - 0x60]
push esi
call dword [0x75ea0228]
test eax, eax
je 0x75e7b21d
and esi, 0xffff
jmp 0x75e7b21f
xor esi, esi
push dword [ebp - 0x60]
call edi
test esi, esi
je 0x75e7b1c1
push esi
push 0x75e7b2c8
push 9
push dword [ebp - 0x68]
call fcn.75e3bbb9
xor eax, eax
add esp, 0x10
inc eax
jmp 0x75e7b1c3
Function at 0x75e7c21d
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp dword [eax + 0x1d4], 0
push esi
je 0x75e7c25f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [0x7ffe02d8]
add eax, 0x1d4
cmp dword [eax], ecx
je 0x75e7c25f
xor esi, esi
inc esi
jmp 0x75e7c262
push 2
pop esi
push esi
push 0x75e7476c
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.75e3bbb9
add esp, 0x10
push 0x75e74744
push 9
lea eax, [ebp - 0x20]
push eax
push 0x75e47cd4
lea eax, [ebp - 0xc]
push eax
push 0x75e74734
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
cmp eax, 0xffffffff
je 0x75e7c2b8
cmp word [ebp - 0x20], 0
je 0x75e7c2b8
push 0x92
lea eax, [ebp - 0x20]
push eax
call sym.USER32.dll_LoadKeyboardLayoutW
inc esi
cmp esi, 0x3e8
jb 0x75e7c262
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.75e36120
leave
ret
Function at 0x75e7d2cc
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x490
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
xor edi, edi
push eax
mov dword [ebp - 0x460], edi
lea ebx, [ebp - 0x45c]
mov dword [ebp - 0x464], edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x470], eax
cmp eax, edi
jne 0x75e7d326
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.75e36120
leave
ret
cmp eax, esi
jbe 0x75e7d339
xor eax, eax
mov word [ebp - 0x210], ax
mov dword [ebp - 0x470], edi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x75e74778
lea eax, [ebp - 0x478]
push eax
call esi
lea eax, [ebp - 0x478]
mov dword [ebp - 0x488], eax
lea eax, [ebp - 0x490]
push eax
push 0x20019
lea eax, [ebp - 0x46c]
push eax
mov dword [ebp - 0x490], 0x18
mov dword [ebp - 0x48c], edi
mov dword [ebp - 0x484], 0x40
mov dword [ebp - 0x480], edi
mov dword [ebp - 0x47c], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x75e7d315
push 0x75e7d4b0
lea eax, [ebp - 0x478]
push eax
call esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp - 0x468]
push eax
push 0x40
lea eax, [ebp - 0x45c]
push eax
push 2
lea eax, [ebp - 0x478]
push eax
push dword [ebp - 0x46c]
call esi
mov edi, 0x80000005
jmp 0x75e7d42d
cmp dword [ebp - 0x464], 0
je 0x75e7d3ec
push ebx
call dword [sym.imp.kernel32.dll_GlobalFree]
push dword [ebp - 0x468]
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x75e7d494
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
lea eax, [ebp - 0x478]
push ebx
push 2
push eax
push dword [ebp - 0x46c]
mov dword [ebp - 0x464], 1
call esi
cmp eax, edi
je 0x75e7d3dc
test eax, eax
jl 0x75e7d47c
cmp dword [ebp - 0x470], 0
je 0x75e7d46c
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x75e7d4d0
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.75e3bbb9
add esp, 0x14
test eax, eax
lea eax, [ebp - 0x41c]
jge 0x75e7d46f
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x464], 0
je 0x75e7d48c
push ebx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov esi, dword [ebp - 0x460]
jmp 0x75e7d49d
push 0xe
call fcn.75e43a4f
xor esi, esi
push dword [ebp - 0x46c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x75e7d317
Function at 0x75e81021
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x13
pop eax
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 2
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
test eax, eax
jl 0x75e81118
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push edi
call dword [sym.imp.advapi32.dll_CheckTokenMembership]
test eax, eax
je 0x75e810a5
cmp dword [ebp - 0x1c], ebx
je 0x75e810a5
push 0x18
pop eax
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationToken]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 3
push edi
call esi
cmp eax, 0xc0000023
jne 0x75e81117
push dword [ebp - 0x18]
push 8
push dword [0x75ea010c]
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x75e81117
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push 3
push edi
call esi
test eax, eax
jl 0x75e81117
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
xor edi, edi
cmp esi, ebx
jbe 0x75e81117
add eax, 4
mov ecx, dword [eax]
mov edx, dword [eax + 4]
cmp ecx, dword [ebp - 0x28]
jne 0x75e81106
cmp edx, dword [ebp - 0x24]
je 0x75e81110
inc edi
add eax, 0xc
cmp edi, esi
jae 0x75e81117
jmp 0x75e810f7
mov dword [ebp - 0x20], 1
pop esi
cmp dword [ebp - 0x14], ebx
je 0x75e81126
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_RtlFreeSid]
cmp dword [ebp - 0x10], ebx
je 0x75e8113b
push dword [ebp - 0x10]
push ebx
push dword [0x75ea010c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
pop edi
xor ecx, ebp
pop ebx
call fcn.75e36120
leave
ret 4