joyce8/EMBER2024-capa huggingface dataset:
Function at 0xffe896f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.0ffe8845
cmp eax, ebx
jne 0xffe8a1e
cmp dword [ebp - 0xc], ebx
jne 0xffe89f4
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringA]
cmp eax, ebx
jne 0xffe8a1e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0xffd5d08
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0xffe8a1e
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
mov esi, 0xffd5cfc
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0xffe89fb
mov esi, 0x80090020
jmp 0xffe8a20
mov eax, dword [ebp - 4]
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xffe8a02
sub eax, edi
inc eax
push eax
push dword [ebp - 4]
push 1
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov esi, eax
cmp dword [ebp - 4], ebx
je 0xffe8a2f
lea eax, [ebp - 4]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeA]
cmp dword [ebp - 0xc], ebx
je 0xffe8a3c
push dword [ebp - 0xc]
call fcn.0ffe82e0
cmp dword [ebp - 8], ebx
je 0xffe8a4a
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xffe9000
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
xor ebx, ebx
lea eax, [ebp - 0x420]
push esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
push edi
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
push 1
push 0x2000000
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0x400
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0xffe9064
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0xffe9088
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0xffe913e
cmp dword [ebp - 4], ebx
je 0xffe909b
push dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0xffe907b
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x420]
push eax
push 1
push dword [ebp - 0xc]
call esi
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0xffe90f3
call edi
cmp eax, 0x7a
jne 0xffe9081
push dword [ebp - 8]
call fcn.0ffe82b0
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jne 0xffe90db
push 8
pop edi
jmp 0xffe9131
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x20], eax
push eax
push 1
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0xffe90f3
jmp 0xffe9112
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0xffe9118
call edi
mov edi, eax
jmp 0xffe9131
mov eax, dword [ebp - 0x20]
push dword [eax]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0xffe912f
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
cmp dword [ebp - 0x1c], ebx
je 0xffe913e
push dword [ebp - 0x1c]
call fcn.0ffe82e0
cmp dword [ebp - 0x10], ebx
je 0xffe914c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 4], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0xffe915c
push dword [ebp - 4]
call esi
cmp dword [ebp - 0xc], ebx
je 0xffe9166
push dword [ebp - 0xc]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xffe916f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push 8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x400
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x418]
mov dword [ebp - 0xc], ebx
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], 5
call fcn.0ffe850f
cmp eax, ebx
jne 0xffe91e4
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x418]
push eax
push 1
push dword [ebp - 8]
call esi
test eax, eax
jne 0xffe9211
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0xffe91e8
mov esi, eax
jmp 0xffe925d
push dword [ebp - 4]
call fcn.0ffe82b0
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0xffe91fc
push 8
pop esi
jmp 0xffe9250
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
mov edi, eax
push eax
push 1
push dword [ebp - 8]
call esi
test eax, eax
je 0xffe9230
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0xffe923a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0xffe9250
push dword [edi]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0xffe924e
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor esi, esi
cmp dword [ebp - 0x18], ebx
je 0xffe925d
push dword [ebp - 0x18]
call fcn.0ffe82e0
cmp dword [ebp - 0xc], ebx
je 0xffe926b
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 8], ebx
je 0xffe9279
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0xffe9645
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
cmp eax, 2
mov ebx, 0x104
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [esi], edi
je 0xffe9698
cmp eax, 1
je 0xffe9698
cmp eax, 0xc
je 0xffe9698
cmp eax, 0x18
je 0xffe9698
cmp eax, 3
je 0xffe968f
cmp eax, 0xd
je 0xffe968f
cmp eax, 0x12
jne 0xffe969f
mov dword [ebp - 0xc], 0xffd5e44
jmp 0xffe969f
mov dword [ebp - 0xc], 0xffd5e14
cmp dword [ebp + 0xc], edi
jne 0xffe9723
push esi
call fcn.0ffe916f
cmp eax, edi
jne 0xffe980b
cmp dword [esi], edi
jne 0xffe9723
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USERENV.dll_GetProfileType]
test eax, eax
jne 0xffe96cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xffe980b
test byte [ebp - 8], 4
jne 0xffe9719
test byte [ebp - 8], 1
je 0xffe96e1
test byte [ebp - 8], 2
je 0xffe9719
lea eax, [ebp - 4]
push eax
push 0xc
call fcn.0ffe850f
cmp eax, edi
jne 0xffe9704
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 4]
call dword [sym.imp.USERENV.dll_Ordinal_149]
cmp eax, edi
je 0xffe970b
mov esi, eax
jmp 0xffe9813
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], edi
jmp 0xffe9745
mov esi, 0x80090024
jmp 0xffe9821
cmp dword [ebp + 0x10], edi
lea eax, [ebp - 0x21c]
jne 0xffe9754
push eax
push edi
push edi
push 0x8023
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jne 0xffe980b
lea eax, [ebp - 0x21c]
push eax
call sub.msvcrt.dll_wcslen
pop ecx
jmp 0xffe975c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
shl ebx, 1
cmp ebx, edi
jne 0xffe976e
mov esi, 0x80090020
jmp 0xffe9821
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp + 0xc]
call fcn.0ffe95f7
cmp eax, edi
jne 0xffe980b
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax - 2]
mov dword [ebp + 0x14], eax
lea eax, [eax + ebx + 0x30]
push eax
call fcn.0ffe82b0
cmp eax, edi
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0xffe97ab
push 8
pop esi
jmp 0xffe9821
mov edi, eax
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [ebp - 0x21c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xc]
add eax, ebx
push 0xb
mov edi, eax
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x14]
push dword [ebp + 0xc]
mov edx, ecx
add eax, 0x2c
shr ecx, 2
mov edi, eax
lea esi, [ebp - 0x424]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [eax + 1], 0
mov byte [eax], 0x5c
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
lea ecx, [eax + ebx + 2]
push ecx
push eax
call fcn.0ffe8e80
test eax, eax
je 0xffe980f
mov esi, eax
jmp 0xffe9821
xor esi, esi
xor edi, edi
cmp dword [ebp - 4], edi
je 0xffe9821
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0xffe9a5d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
and dword [ebp - 4], 0
or dword [ebp - 8], 0xffffffff
push esi
mov esi, dword [ebp + 0x14]
or dword [esi], 0xffffffff
push edi
xor eax, eax
push 0x11
mov ecx, 0x94
lea edi, [ebp - 0x2a0]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0xc]
call fcn.0ffe87b2
xor edi, edi
cmp eax, edi
jne 0xffe9aef
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
mov word [ebp - 0x10], 0x5f
mov word [ebp - 0xe], 0x2a
call fcn.0ffe982a
cmp eax, edi
jne 0xffe9aef
push edi
push edi
push edi
lea eax, [ebp - 0x2a0]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0xffe9af3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xffe9aef
mov esi, 0x80090016
jmp 0xffe9b63
mov esi, eax
jmp 0xffe9b63
push dword [ebp - 4]
call fcn.0ffe82e0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x274]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.0ffe982a
cmp eax, edi
jne 0xffe9b47
push edi
push 0x8000000
push 3
push edi
push 1
push 0x80000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0xffe9b4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xffe9b47
mov esi, 0x80090016
jmp 0xffe9b5e
mov esi, eax
jmp 0xffe9b5e
lea eax, [ebp - 0x274]
push eax
push dword [ebp + 0x10]
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
xor esi, esi
cmp dword [ebp - 8], edi
je 0xffe9b6c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], edi
je 0xffe9b79
push dword [ebp - 4]
call fcn.0ffe82e0
pop edi
mov eax, esi
pop esi
leave
ret 0x10

Function at 0xffe9b81
Capabilities:
Check if file exists
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push 4
push 3
push esi
push esi
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0xffe9bbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xffe9bbb
mov edi, 0x80090016
jmp 0xffe9c1e
mov edi, eax
jmp 0xffe9c1e
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0xffe9bd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0xffe9c15
push ebx
push edi
call fcn.0ffe82b0
mov ebx, eax
cmp ebx, esi
jne 0xffe9bea
push 8
pop edi
jmp 0xffe9c0a
push esi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0xffe9c08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0xffe9c0a
xor edi, edi
cmp ebx, esi
je 0xffe9c14
push ebx
call fcn.0ffe82e0
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0xffe9c26
Capabilities:
Delete file

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push esi
call sub.msvcrt.dll_wcslen
push dword [esp + 0x18]
mov ebx, eax
shl ebx, 1
call sub.msvcrt.dll_wcslen
mov ebp, eax
pop ecx
shl ebp, 1
lea eax, [ebx + ebp]
pop ecx
lea eax, [eax + eax + 2]
push eax
call fcn.0ffe82b0
test eax, eax
mov dword [esp + 0x10], eax
jne 0xffe9c60
push 8
pop esi
jmp 0xffe9cb9
push edi
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
lea ecx, [ebp + 2]
mov edx, ecx
shr ecx, 2
lea edi, [ebx + eax]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0ffe9b81
test eax, eax
pop edi
jne 0xffe9caa
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0xffe9cae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0xffe9cb0
xor esi, esi
push dword [esp + 0x10]
call fcn.0ffe82e0
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0xffea574
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0x80000000
push dword [ebp + 8]
call fcn.0ffe9996
xor esi, esi
cmp eax, esi
je 0xffea5aa
cmp eax, 2
jne 0xffea5c2
mov edi, 0x80090016
jmp 0xffea671
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
jne 0xffea5c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0xffea671
cmp eax, 0x20
jae 0xffea5d8
mov edi, 0x8009001a
jmp 0xffea671
push esi
push esi
push esi
push 2
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0xffea5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0xffea663
push ebx
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, esi
jne 0xffea615
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0xffea657
cmp dword [ebx], 2
jne 0xffea63b
mov edi, dword [ebp + 0x14]
cmp edi, esi
mov eax, dword [ebp + 0x18]
jne 0xffea62c
mov dword [eax], 0x105
jmp 0xffea655
mov ecx, dword [ebx + 8]
cmp dword [eax], ecx
jb 0xffea624
lea eax, [ecx + 0x28]
cmp eax, dword [ebp + 0x10]
jbe 0xffea642
mov edi, 0x8009001a
jmp 0xffea657
mov eax, ecx
shr ecx, 2
lea esi, [ebx + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
xor edi, edi
cmp ebx, esi
je 0xffea662
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop ebx
cmp dword [ebp + 0xc], esi
je 0xffea671
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0xffffffff
je 0xffea680
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0xffea7c3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x94
lea edi, [ebp - 0x260]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call fcn.0ffe9645
cmp eax, ebx
jne 0xffea8a8
test byte [ebp + 0x10], 1
mov esi, dword [ebp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
je 0xffea8af
push dword [ebp - 4]
or dword [esi], 0xffffffff
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 4]
push eax
call fcn.0ffe82b0
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0xffea840
push 8
pop esi
jmp 0xffea932
push dword [ebp - 4]
push eax
call sub.msvcrt.dll_wcscpy
push dword [ebp - 4]
call sub.msvcrt.dll_wcslen
mov ecx, dword [ebp - 0xc]
add esp, 0xc
push ebx
push ebx
push ebx
mov word [ecx + eax*2], 0x2a
lea eax, [ebp - 0x260]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0xffea89e
lea ecx, [ebp - 0x260]
push ecx
push eax
call edi
test eax, eax
je 0xffea893
lea eax, [ebp - 0x260]
push eax
push dword [esi]
call edi
test eax, eax
jne 0xffea8c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0xffea8a8
mov esi, 0x103
jmp 0xffea932
mov esi, eax
jmp 0xffea932
lea eax, [ebp - 0x260]
push eax
push dword [esi]
call edi
test eax, eax
je 0xffea959
cmp dword [ebp + 0xc], ebx
jne 0xffea8cc
cmp dword [ebp - 0x10], ebx
je 0xffea907
lea eax, [ebp - 8]
push eax
call fcn.0ffe8845
cmp eax, ebx
jne 0xffea955
cmp dword [ebp - 8], ebx
jne 0xffea8f4
mov esi, 0x80090020
jmp 0xffea932
lea eax, [ebp - 0x260]
push eax
push dword [esi]
call edi
test eax, eax
je 0xffea959
push dword [ebp - 8]
lea eax, [ebp - 0x234]
push eax
call fcn.0ffea77e
test eax, eax
je 0xffea8e5
push dword [ebp + 0x18]
lea eax, [ebp - 0x234]
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.0ffea574
cmp eax, ebx
jne 0xffea8af
xor esi, esi
cmp dword [ebp - 8], ebx
je 0xffea932
push dword [ebp - 8]
call fcn.0ffe82e0
cmp dword [ebp - 4], ebx
je 0xffea93f
push dword [ebp - 4]
call fcn.0ffe82e0
cmp dword [ebp - 0xc], ebx
je 0xffea94c
push dword [ebp - 0xc]
call fcn.0ffe82e0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, eax
jmp 0xffea925
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0xffea955
mov esi, 0x103
jmp 0xffea925
Function at 0xffeaa40
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
xor ebx, ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
xor eax, eax
push 2
mov ecx, 0x105
lea edi, [ebp - 0x41c]
push ebx
mov dword [ebp - 8], ebx
rep stosd dword es:[edi], eax
call esi
mov edi, eax
cmp edi, ebx
jne 0xffeaa82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0xffeaaee
lea eax, [edi + 1]
cmp eax, 0x20a
jbe 0xffeaaab
lea eax, [edi + edi + 2]
push eax
call fcn.0ffe82b0
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0xffeaaa2
push 8
pop esi
jmp 0xffeaaee
mov dword [ebp - 8], 1
jmp 0xffeaab4
lea eax, [ebp - 0x41c]
mov dword [ebp - 4], eax
push edi
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 2
push ebx
call esi
test eax, eax
jne 0xffeaace
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xffeaada
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 8], ebx
mov esi, eax
je 0xffeaaee
cmp dword [ebp - 4], ebx
je 0xffeaaee
push dword [ebp - 4]
call fcn.0ffe82e0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0xffeafef
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xf4], ebx
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0xffeb015
xor edi, edi
jmp 0xffeb149
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x40]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0ffeaaf7
cmp eax, ebx
jne 0xffeb152
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.0ffea96b
cmp eax, ebx
je 0xffeb06b
cmp eax, 0x80090016
jne 0xffeb152
mov edi, 0x103
jmp 0xffeb114
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
jne 0xffeb152
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0xffeb112
mov eax, dword [ebp + 0x10]
inc eax
mov dword [esi + 0xf0], eax
imul eax, ecx
push eax
mov dword [esi + 0xec], ecx
call fcn.0ffe82b0
cmp eax, ebx
mov dword [esi + 0xf4], eax
jne 0xffeb0ce
push 8
pop edi
jmp 0xffeb114
xor edi, edi
cmp dword [esi + 0xec], ebx
jbe 0xffeb102
mov ecx, dword [esi + 0xf0]
mov eax, ecx
imul eax, edi
add eax, dword [esi + 0xf4]
push ecx
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, ebx
jne 0xffeb152
inc edi
cmp edi, dword [esi + 0xec]
jb 0xffeb0d8
cmp dword [ebp + 0x14], ebx
jne 0xffeb156
mov eax, dword [esi + 0xf0]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0xffeb132
cmp eax, 0x80000001
je 0xffeb132
cmp eax, 0x80000002
je 0xffeb132
push eax
call esi
cmp dword [ebp - 8], ebx
je 0xffeb13f
push dword [ebp - 8]
call fcn.0ffe82e0
cmp dword [ebp - 4], ebx
je 0xffeb149
push dword [ebp - 4]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
mov edi, eax
jmp 0xffeb114
mov esi, dword [esi + 0xf0]
mov eax, dword [ebp + 0x18]
cmp dword [eax], esi
mov dword [eax], esi
jae 0xffeb112
mov edi, 0xea
jmp 0xffeb114
Function at 0xffeb754
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x12c
push 0xffd5f88
call fcn.0ffe2550
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
push eax
push 0x20019
push ebx
push 0xffd5f60
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x30], eax
cmp eax, ebx
jne 0xffeb84b
mov dword [ebp - 0x34], 0x105
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x13c]
push eax
push ebx
push ebx
mov edi, 0xffd5f54
push edi
push dword [ebp - 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
mov dword [ebp - 0x30], eax
cmp eax, ebx
je 0xffeb7fd
cmp eax, 0xea
jne 0xffeb84b
push dword [ebp - 0x34]
call fcn.0ffe82b0
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0xffeb84b
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x34]
push ecx
push eax
push ebx
push ebx
push edi
push 0x80000002
call esi
mov dword [ebp - 0x30], eax
cmp eax, ebx
je 0xffeb806
jmp 0xffeb84b
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x1c], eax
push 0xc
pop edi
push edi
call fcn.0ffe82b0
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, ebx
je 0xffeb84b
mov dword [esi], edi
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [esi + 4], eax
cmp eax, ebx
je 0xffeb84b
push 0xffd5f44
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
cmp eax, ebx
je 0xffeb84b
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [ebp - 0x2c], 1
or dword [ebp - 4], 0xffffffff
jmp 0xffeb85e
cmp dword [ebp - 0x28], ebx
je 0xffeb86c
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20], ebx
je 0xffeb87e
cmp dword [ebp - 0x1c], ebx
je 0xffeb87e
push dword [ebp - 0x1c]
call fcn.0ffe82e0
cmp dword [ebp - 0x2c], ebx
jne 0xffeb88b
push dword [ebp - 0x24]
call fcn.0ffeb733
mov eax, dword [ebp - 0x2c]
call fcn.0ffe2589
ret 4