joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75afa1d5
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20c], ebx
cmp eax, ebx
jne 0x75afa264
cmp dword [esi], ebx
jne 0x75afa228
call fcn.759b3e2d
push eax
push dword [0x75bc8b74]
push ebx
push 0x759b4a48
push 0x80000002
call fcn.759b3f15
add esp, 0x14
cmp eax, ebx
jne 0x75afa2a1
mov eax, dword [esi]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x208]
push ecx
push dword [esi + 0x1c]
mov dword [ebp - 0x210], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x20c], eax
cmp eax, ebx
jne 0x75afa298
push edi
lea edx, [ebp - 0x208]
push edx
jmp 0x75afa2bd
cmp eax, 1
jne 0x75afa284
mov eax, dword [esi + 0x1c]
cmp eax, ebx
jne 0x75afa27f
push edi
call fcn.75b3181a
pop ecx
mov dword [ebp - 0x20c], eax
jmp 0x75afa298
cmp eax, 1
jmp 0x75afa2b5
cmp eax, 2
jne 0x75afa2b2
cmp dword [esi + 0x1c], ebx
je 0x75afa270
mov dword [ebp - 0x20c], 0x103
inc dword [esi + 0x1c]
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret 4
cmp dword [esi + 0x1c], ebx
jne 0x75afa28e
push edi
push 0x75afa2c8
mov eax, dword [edi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
jmp 0x75afa298
Function at 0x75afb1e7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x75afb220
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
xor eax, eax
inc eax
jmp 0x75afb357
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call ebx
push dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x224], eax
call fcn.75a20380
pop ecx
cmp eax, 3
jne 0x75afb265
push 0
push dword [ebp - 0x224]
mov ecx, esi
call fcn.759b593b
test al, al
je 0x75afb3c7
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
jmp 0x75afb33b
mov eax, 0x104
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ecx
test edi, edi
je 0x75afb291
cmp word [edi], 0
je 0x75afb291
push edi
call ebx
mov dword [ebp - 0x21c], eax
jmp 0x75afb2ef
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call edi
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x75afb3bc
cmp eax, dword [ebp - 0x214]
jbe 0x75afb2e9
push 0
push eax
lea ecx, [ebp - 0x218]
call fcn.759b444d
test al, al
je 0x75afb3bc
push dword [ebp - 0x218]
push dword [ebp - 0x214]
call edi
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x75afb3bc
mov edi, dword [ebp - 0x218]
mov eax, dword [ebp - 0x220]
cmp word [eax], 0x5c
jne 0x75afb365
mov eax, dword [ebp - 0x224]
push 0
add eax, 2
push eax
mov ecx, esi
call fcn.759b593b
test al, al
je 0x75afb3bc
mov cx, word [edi]
mov eax, dword [esi]
mov word [eax], cx
mov eax, dword [esi]
mov cx, word [edi + 2]
mov word [eax + 2], cx
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 4], cx
lea ecx, [ebp - 0x218]
call fcn.759b170a
push dword [ebp - 0x220]
mov eax, dword [esi + 4]
mov esi, dword [esi]
push eax
push esi
call fcn.759b3d8c
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.759b1748
leave
ret
push edi
call ebx
mov ecx, dword [ebp - 0x224]
lea eax, [ecx + eax + 2]
push 0
push eax
mov ecx, esi
call fcn.759b593b
test al, al
je 0x75afb3bc
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.759b3cf5
test eax, eax
jl 0x75afb3bc
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x75afb330
cmp word [edi + eax*2 - 2], 0x5c
je 0x75afb330
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x759b4930
push eax
push ecx
call fcn.759b3d8c
test eax, eax
jge 0x75afb330
lea ecx, [ebp - 0x218]
call fcn.759b170a
xor eax, eax
jmp 0x75afb356
Function at 0x75afcb38
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x598
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x598], edi
cmp dword [esi], ebx
jne 0x75afccae
lea ecx, [ebp - 0x378]
call fcn.759b3c2d
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push eax
push 0x759b4a48
mov edi, 0x759b4d84
push edi
lea eax, [ebp - 0x35c]
push 0x13f
push eax
call fcn.759b4c31
add esp, 0x14
test eax, eax
jge 0x75afcbbf
mov edi, 0x65b
lea ecx, [ebp - 0x378]
call fcn.759b3c00
lea ecx, [ebp - 0x370]
call fcn.759b1681
mov eax, edi
jmp 0x75afcd0d
lea ecx, [ebp - 0x378]
call fcn.759b3e2d
push eax
push dword [0x75bc8b74]
lea eax, [ebp - 0x35c]
push ebx
push eax
push 0x80000002
call fcn.759b3f15
add esp, 0x14
cmp eax, ebx
je 0x75afcbee
mov edi, eax
jmp 0x75afcba2
push 1
lea eax, [ebp - 0x580]
push 0x21
mov dword [ebp - 0x58c], eax
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x48]
push ecx
mov dword [ebp - 0x588], 0x104
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push eax
call fcn.759b449f
lea eax, [ebp - 0x48]
push eax
push 0x759b4308
push edi
push dword [ebp - 0x588]
push dword [ebp - 0x58c]
call fcn.759b4c31
add esp, 0x24
test eax, eax
jge 0x75afcc4d
lea ecx, [ebp - 0x58c]
call fcn.759b170a
jmp 0x75afcb9d
mov eax, dword [ebp - 0x378]
mov edi, dword [ebp - 0x58c]
mov ecx, esi
mov dword [ebp - 0x590], eax
call fcn.759b3e2d
push eax
push dword [0x75bc8b74]
push ebx
push edi
push dword [ebp - 0x590]
call fcn.759b3f15
add esp, 0x14
lea ecx, [ebp - 0x58c]
mov edi, eax
call fcn.759b170a
cmp edi, ebx
jne 0x75afcba2
lea ecx, [ebp - 0x378]
call fcn.759b3c00
lea ecx, [ebp - 0x370]
call fcn.759b1681
mov edi, dword [ebp - 0x598]
mov eax, dword [esi + 0x1c]
push ebx
push ebx
push ebx
lea ecx, [eax + 1]
mov dword [esi + 0x1c], ecx
mov esi, dword [esi]
push ebx
lea ecx, [ebp - 0x594]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push eax
push esi
mov dword [ebp - 0x594], 0x21
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x75afcd0d
push 1
push 0x27
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.759b5b89
mov eax, dword [edi]
mov ecx, dword [eax]
add esp, 0x10
push edi
lea edx, [ebp - 0xdc]
push edx
push eax
call dword [ecx + 0x28]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret 4
Function at 0x75b14d80
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x100000
push 1
push ebx
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x75b14dc3
xor eax, eax
jmp 0x75b14e91
push 0x200
lea ecx, [ebp - 0x14]
call fcn.759da627
cmp dword [ebp - 0x14], ebx
jne 0x75b14df6
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x10], 1
jle 0x75b14dbc
push dword [ebp - 0x14]
call fcn.759c6f79
pop ecx
jmp 0x75b14dbc
mov eax, dword [edi]
mov esi, dword [ebp - 0x10]
push 5
push edi
call dword [eax + 0x20]
mov edi, eax
mov dword [ebp - 0x18], ebx
cmp edi, ebx
je 0x75b14e4e
lea ecx, [ebp - 0x18]
call fcn.759c6f3c
mov ecx, dword [edi]
push eax
push 0x75a1085c
push edi
call dword [ecx]
test eax, eax
jne 0x75b14e4e
jmp 0x75b14e51
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, ebx
je 0x75b14e51
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x75b14e51
or esi, 0xffffffff
cmp esi, dword [ebp - 0x10]
je 0x75b14e23
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, 0xffffffff
setne al
mov esi, eax
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x75b14e76
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
je 0x75b14e80
mov eax, dword [edi]
push edi
call dword [eax + 8]
cmp dword [ebp - 0x10], 1
jle 0x75b14e8f
push dword [ebp - 0x14]
call fcn.759c6f79
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret 8
Function at 0x75b14ec6
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x22c], 0
push ebx
push esi
lea eax, [ebp - 0x22c]
push edi
push eax
mov esi, ecx
call sub.msvcrt.dll_time
push eax
call sub.msvcrt.dll_srand
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
mov ebx, 0x104
push eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], ebx
call fcn.75a33c1d
add esp, 0xc
push dword [ebp - 0x218]
lea ecx, [ebp - 0x21c]
call fcn.759c6e99
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
mov edi, 0x759b4930
push edi
push 4
push eax
call dword [ecx + 0x5c]
test eax, eax
jne 0x75b14f5a
push edi
lea ecx, [ebp - 0x21c]
call fcn.759ca705
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push 0x103
push esi
push eax
call dword [ecx + 0x24]
and dword [ebp - 0x220], 0
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x220], 0
jne 0x75b15012
mov eax, dword [ebp - 0x218]
mov edi, dword [ebp - 0x214]
mov dword [ebp - 0x228], eax
call sub.msvcrt.dll_rand
push eax
push esi
push 0x75b15078
push edi
push dword [ebp - 0x228]
call fcn.759b4c31
add esp, 0x14
test eax, eax
jl 0x75b15016
push 0
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x75b14fe7
push dword [ebp - 0x218]
push ebx
push esi
call fcn.759b3cf5
test eax, eax
jl 0x75b15046
mov dword [ebp - 0x220], 1
jmp 0x75b14ff6
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
jne 0x75b1506b
inc dword [ebp - 0x224]
cmp dword [ebp - 0x224], 0xa
jl 0x75b14f7a
cmp dword [ebp - 0x220], 0
je 0x75b15046
xor esi, esi
jmp 0x75b15050
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x218]
call fcn.759b170a
mov eax, 0x65b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
xor eax, eax
mov word [esi], ax
mov esi, 0x65b
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x218]
call fcn.759b170a
mov eax, esi
jmp 0x75b15037
xor eax, eax
mov word [esi], ax
call edi
mov esi, eax
jmp 0x75b15050
Function at 0x75b22000
Capabilities:
Check if file exists
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x28], eax
test ebx, ebx
je 0x75b22118
cmp word [ebx], 0
je 0x75b22118
test eax, eax
je 0x75b22118
cmp word [eax], 0
je 0x75b22118
xor esi, esi
inc esi
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x18]
mov edi, 0x104
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
call fcn.759c5bb8
test al, al
je 0x75b22101
push esi
push edi
lea ecx, [ebp - 0x24]
call fcn.759c5bb8
test al, al
je 0x75b22101
push ebx
lea eax, [ebp - 0x14]
push eax
push 0
mov dword [ebp - 0xc], esi
call fcn.75b16eeb
add esp, 0xc
test eax, eax
je 0x75b2209a
mov esi, eax
jmp 0x75b22104
push 0x759b4930
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.759b3d8c
test eax, eax
jge 0x75b220b5
mov esi, 0x65b
jmp 0x75b22104
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
push 0
mov dword [ebp - 0x1c], esi
call fcn.75b16eeb
add esp, 0xc
test eax, eax
jne 0x75b22096
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x75b220ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x75b220ed
cmp eax, 3
jne 0x75b22096
lea ecx, [ebp - 0x24]
call fcn.759b1681
lea ecx, [ebp - 0x14]
call fcn.759b1681
xor eax, eax
jmp 0x75b2211b
push 0xe
pop esi
lea ecx, [ebp - 0x24]
call fcn.759b1681
lea ecx, [ebp - 0x14]
call fcn.759b1681
mov eax, esi
jmp 0x75b2211b
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
Function at 0x75b30e6a
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x75bcc8ec]
cmp eax, 2
je 0x75b30e79
cmp eax, 3
jne 0x75b30e81
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x75b31185
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 8]
or esi, 0xffffffff
call fcn.75b31107
mov edi, dword [ebp - 8]
add esp, 0xc
test eax, eax
jne 0x75b311e3
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
call fcn.75b31107
add esp, 0xc
test eax, eax
jne 0x75b311e3
test edi, edi
je 0x75b311ee
mov eax, dword [ebp - 4]
test eax, eax
je 0x75b311e3
push dword [eax]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, eax
neg esi
sbb esi, esi
neg esi
test edi, edi
je 0x75b311ee
push edi
call fcn.759c6f79
pop ecx
cmp dword [ebp - 4], 0
je 0x75b311fd
push dword [ebp - 4]
call fcn.759c6f79
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x75b313fc
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 0xc]
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.759ceba1
add esp, 0x10
test eax, eax
je 0x75b31434
push eax
push 0xb5b
call fcn.75a20457
pop ecx
pop ecx
leave
ret
push esi
push 1
lea ecx, [ebp - 4]
call fcn.75a1d306
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
push 1
push dword [ebp + 8]
call esi
test eax, eax
je 0x75b31474
push dword [ebp - 8]
push 4
push dword [ebp + 8]
call esi
test eax, eax
je 0x75b31474
cmp dword [ebp - 4], 2
je 0x75b31470
push dword [ebp - 4]
call fcn.75a1d2ce
pop ecx
xor eax, eax
jmp 0x75b3149e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x786
call fcn.75a207b8
add esp, 0xc
cmp dword [ebp - 4], 2
mov esi, eax
je 0x75b3149c
push dword [ebp - 4]
call fcn.75a1d2ce
pop ecx
mov eax, esi
pop esi
leave
ret

Function at 0x75b31569
Capabilities:
Allocate thread local storage
Set thread local storage value
Terminate process

Disassembly:
call fcn.759b3eb3
cmp dword [0x75bcc8ec], 2
je 0x75b3157c
cmp eax, 1
jne 0x75b315d8
push esi
mov esi, 0x75bcc964
jmp 0x75b3158c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.759b16ea
test al, al
jne 0x75b31584
mov eax, dword [0x75bcc8d8]
pop esi
cmp eax, 0xffffffff
jne 0x75b315bd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x75bcc8d8], eax
cmp eax, 0xffffffff
jne 0x75b315bd
and dword [0x75bcc964], 0
jmp fcn.75b30e6a
and dword [0x75bcc964], 0
push 0x40000001
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je fcn.75b30e6a
ret
Function at 0x75b31956
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call fcn.75a3aae6
mov esi, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
push dword [ebp + 0xc]
xor edi, edi
push edi
push 0x75a09a20
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x75b3198d
mov eax, dword [esi]
push esi
call dword [eax + 8]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.75b313fc
pop ecx
pop ecx
cmp eax, edi
je 0x75b319b1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or edi, 0xffffffff
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, edi
jmp 0x75b31989
push edi
push 0x100000
push 5
push edi
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
jmp 0x75b319a7
Function at 0x75b31f36
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
push edi
push 0xc
lea eax, [ebp - 0x20]
push eax
push 0x25
call dword [0x75bc8c78]
test eax, eax
jne 0x75b31ffa
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 3
mov esi, 0x75b322a4
cmp eax, edi
je 0x75b31f9b
shl eax, 0xa
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov esi, edx
sub esi, eax
cmp esi, ecx
jb 0x75b31f8a
mov al, 1
jmp 0x75b32022
sub eax, edx
add eax, ecx
mov dword [ebp - 8], eax
lea esi, [ebp - 8]
mov dword [ebp - 4], 1
push edi
call fcn.75b314f1
pop ecx
mov ebx, 0x759cc3f0
test al, al
je 0x75b31fb6
push ebx
call fcn.75b315de
pop ecx
test al, al
je 0x75b31ffa
push 1
lea ecx, [ebp - 0x14]
call fcn.759b87f0
push ebx
call fcn.759ce075
pop ecx
test al, al
je 0x75b31ff2
cmp dword [ebp - 4], edi
je 0x75b31ff2
mov eax, dword [esi]
add eax, dword [ebp - 0xc]
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x25
call dword [0x75bc8b70]
test eax, eax
je 0x75b32027
add esi, 4
dec dword [ebp - 4]
jne 0x75b31fd0
lea ecx, [ebp - 0x14]
call fcn.759b87d1
cmp dword [0x75bc8ca8], edi
je 0x75b32020
push edi
push edi
mov ecx, 0x759b7ff8
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x75b32260
push edi
push edi
push 9
call fcn.759c26bf
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 2
call fcn.759b172f
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 0x75b32218
push 0x80000002
call dword [0x75bcc908]
cmp eax, edi
jne 0x75b320a0
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push edi
push 0x75b321f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
je 0x75b32095
cmp dword [0x75bc8ca8], edi
je 0x75b32095
push edi
push edi
mov ecx, 0x759b7ff8
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
push 0x75b32168
push edi
push edi
push 9
call fcn.759c26bf
add esp, 0x30
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x75b320c6
cmp dword [0x75bc8ca8], edi
je 0x75b320c6
push edi
push edi
mov ecx, 0x759b7ff8
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
push 0x75b320d8
push edi
push edi
push 9
call fcn.759c26bf
add esp, 0x30
lea ecx, [ebp - 0x14]
call fcn.759b87d1
jmp 0x75b31f83
Function at 0x75b322b5
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
call fcn.759c6e99
mov ecx, 0x20019
mov dword [ebp - 0xc], 0x75bc8fe0
mov esi, ecx
cmp byte [0x75bcca70], bl
je 0x75b322fc
mov esi, dword [ebp + 0x10]
dec esi
neg esi
sbb esi, esi
mov eax, 0x100
and esi, eax
add esi, eax
or esi, ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
lea ecx, [ebp - 8]
push ecx
push esi
push ebx
push eax
push dword [ebp + 8]
call dword [0x75bcc908]
mov edi, eax
cmp edi, ebx
jne 0x75b32357
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x75b3233b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x75b32426
cmp edi, ebx
je 0x75b3237b
push 0x759b1758
lea ecx, [ebp - 0xc]
call fcn.759c8365
jmp 0x75b323f2
cmp dword [ebp - 0x14], ebx
jne 0x75b32426
cmp dword [ebp - 0x10], ebx
jne 0x75b323b8
cmp dword [ebp + 8], 0x80000002
jne 0x75b323dc
xor edi, edi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push dword [edi + 0x75bc8f08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x75b32426
add edi, 4
cmp edi, 0x10
jae 0x75b323dc
jmp 0x75b32394
cmp byte [0x75bcca70], bl
je 0x75b32426
cmp dword [ebp - 0x10], 1
jne 0x75b32426
push ebx
push ebx
push ebx
push ebx
push 0x75b32448
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x75b32426
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0x5c
push 6
push eax
call dword [ecx + 0x50]
push eax
lea ecx, [ebp - 0xc]
call fcn.759c755e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x5c
push 7
push eax
call dword [ecx + 0x58]
test eax, eax
jne 0x75b322fc
push 0x759b1758
lea ecx, [ebp - 4]
call fcn.759c8365
jmp 0x75b322fc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x75b3246d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 4], 3
dec dword [ebp - 4]
push 1
push 1
mov ecx, esi
call fcn.759d029c
test eax, eax
jne 0x75b324e1
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
je 0x75b32508
cmp ebx, 0x5aa
jne 0x75b324e8
push 0
call fcn.75b31f36
pop ecx
test al, al
jne 0x75b324fd
mov esi, dword [esi + 0x1c]
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
push ebx
push eax
push dword [ebp + 8]
push 0x57e
call fcn.75a208dc
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp ebx, 0x3fa
jne 0x75b324c6
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi + 0x10], 0
cmp dword [ebp - 4], 0
je 0x75b324c6
jmp 0x75b32482
xor eax, eax
jmp 0x75b324e1

Function at 0x75b3498b
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [ecx + 0xfc]
jmp fcn.75b2ab42

Function at 0x75b3499b
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [ecx + 0xfc]
jmp fcn.75b2b8dd

Function at 0x75b35060
Capabilities:
Reference sql statements

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x10]
cmp dword [edi], 0
je 0x75b350a6
mov esi, dword [esi + 8]
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x18]
push dword [ebp + 8]
mov esi, eax
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x3c]
mov edi, dword [edi]
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0xc]
test eax, eax
je 0x75b350a2
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, edi
jmp 0x75b350c8
xor edi, edi
jmp 0x75b35098
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [eax]
mov ecx, edi
call fcn.759c6f3c
push eax
push 1
push 0x75b350d0
push 0
push dword [esi + 4]
call dword [ebx + 0x44]
pop ebx
test eax, eax
je 0x75b35071
pop edi
pop esi
pop ebp
ret 4