joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaaf1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00aaf140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00aaf140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00aaf140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00aaf140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xaafbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xaafc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xac187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xaafc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xaafc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push 0x10
push str.DisableSend
push str.SOFTWAREPoliciesCitrixICA_ClientComplianceDisable3rdPartyData
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x402180
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CtxGetBoolean
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxGetNumeric
mov dword [ecx + 4], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxGetString
mov dword [ecx + 8], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxGetSubPathCount
mov dword [ecx + 0xc], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxGetSubPath
mov dword [ecx + 0x10], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxGetValueCount
mov dword [ecx + 0x14], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxGetValue
mov dword [ecx + 0x18], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxSetBoolean
mov dword [ecx + 0x1c], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxSetNumeric
mov dword [ecx + 0x20], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxSetString
mov dword [ecx + 0x24], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxSetValue
mov dword [ecx + 0x28], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxSetFeatureFlag
mov dword [ecx + 0x2c], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxGetFeatureFlag
mov dword [ecx + 0x30], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxSetBlock
mov dword [ecx + 0x34], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxRemoveBlocks
mov dword [ecx + 0x38], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.CtxInitSettingsOrder
mov dword [ecx + 0x3c], eax
push dword [0x449fa4]
call esi
mov ecx, dword [0x449fa0]
push str.IsCEIPLogCollectionAllowed
mov dword [ecx + 0x40], eax
push dword [0x449fb0]
call esi
mov ecx, dword [0x449fa0]
pop esi
mov dword [ecx + 0x44], eax
mov eax, dword [0x449fa0]
cmp dword [eax + 4], 0
je 0x402366
cmp dword [eax + 8], 0
je 0x402366
cmp dword [eax + 0xc], 0
je 0x402366
cmp dword [eax + 0x10], 0
je 0x402366
cmp dword [eax + 0x14], 0
je 0x402366
cmp dword [eax + 0x18], 0
je 0x402366
cmp dword [eax + 0x1c], 0
je 0x402366
cmp dword [eax + 0x20], 0
je 0x402366
cmp dword [eax + 0x24], 0
je 0x402366
cmp dword [eax + 0x28], 0
je 0x402366
cmp dword [eax + 0x2c], 0
je 0x402366
cmp dword [eax + 0x30], 0
je 0x402366
cmp dword [eax + 0x38], 0
je 0x402366
cmp dword [eax + 0x3c], 0
je 0x402366
cmp dword [eax + 0x34], 0
je 0x402366
cmp dword [eax + 0x40], 0
je 0x402366
mov al, 1
ret
xor al, al
ret
Function at 0x402690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
xor ebx, ebx
mov dword [ebp - 0x128], esi
push 0x104
push ebx
push eax
mov dword [ebp - 0x12c], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x128], 0x104
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push 2
push 0x43c924
push 0x43c934
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x402751
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x110], ebx
lea edx, [ecx + 1]
mov dword [ebp - 0x10c], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402720
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
lea ecx, [ebp - 0x120]
call fcn.00402560
cmp dword [ebp - 0x110], 0
mov ebx, 1
mov byte [ebp - 0x121], 0
jne 0x402758
mov byte [ebp - 0x121], 1
test bl, 1
je 0x402799
mov edx, dword [ebp - 0x10c]
cmp edx, 0x10
jb 0x402799
mov ecx, dword [ebp - 0x120]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40278f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40278f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00435eb6
add esp, 8
cmp byte [ebp - 0x121], 0
je 0x4027c9
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 2
push 0x43c924
push 0x43c934
push ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea ecx, [ebp - 0x108]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4027f0
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
mov ecx, esi
call fcn.00402560
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043624e
mov esp, ebp
pop ebp
ret 4
Function at 0x402d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43889d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x449314]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ecx]
xor esi, esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], edx
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
cmp byte [eax + 0xd], 0
jne 0x402e18
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x24], esi
jmp 0x402d75
mov esi, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 8
lea edi, [eax + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, ecx
jb 0x402d85
mov eax, dword [ecx]
cmp dword [edi + 0x14], 8
mov edx, dword [edi + 0x10]
mov dword [ebp - 0x20], edx
jb 0x402d93
mov edi, dword [edi]
cmp esi, edx
mov ecx, edx
cmovb ecx, esi
test ecx, ecx
je 0x402dd8
movzx edx, word [edi]
movzx esi, word [eax]
cmp dx, si
jb 0x402ddc
sub edi, eax
cmp dx, si
ja 0x402dcb
cmp ecx, 1
je 0x402dd2
movzx edx, word [edi + eax + 2]
add eax, 2
dec ecx
movzx esi, word [eax]
cmp dx, si
jae 0x402dae
or eax, 0xffffffff
jmp 0x402de5
mov eax, 1
jmp 0x402de5
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
cmp esi, edx
jbe 0x402de1
or eax, 0xffffffff
jmp 0x402de5
sbb eax, eax
neg eax
shr eax, 0x1f
test al, al
mov eax, dword [ebp - 0x10]
je 0x402df9
mov eax, dword [eax + 8]
xor esi, esi
mov edx, dword [ebp - 0x14]
jmp 0x402e05
mov edx, eax
mov esi, 1
mov eax, dword [eax]
mov dword [ebp - 0x14], edx
cmp byte [eax + 0xd], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
je 0x402d72
mov ecx, dword [ebp - 0x18]
cmp byte [edx + 0xd], 0
mov edi, dword [ebp + 0xc]
jne 0x402e4e
lea eax, [edx + 0x10]
push eax
push edi
call fcn.004031a0
test al, al
jne 0x402e4e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0x4ec4ec4
je 0x402ef7
mov dword [ebp - 0x28], eax
push 0x34
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.00435e86
xor ecx, ecx
add esp, 4
mov dword [eax + 0x10], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
movups xmm0, xmmword [edi]
push eax
push esi
push dword [ebp - 0x1c]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [eax + 0x20], xmm0
mov word [edi], cx
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x18]
mov word [eax + 0xc], 0
call fcn.00403a80
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.00403c90
int3
Function at 0x405830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438add
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
xor bl, bl
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
test esi, esi
je 0x405883
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x405877
mov eax, dword [esi]
xor edx, edx
mov dword [esi + 0x10], 0
mov word [eax], dx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push 2
push ecx
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40594a
mov eax, dword [ebp - 0x2c]
cmp eax, 2
jb 0x40594a
push 0
shr eax, 1
lea ecx, [ebp - 0x28]
push eax
call fcn.004040c0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
add eax, eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 8
push ecx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 2
push dword [ebp - 0x30]
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
sete bl
test eax, eax
jne 0x40590e
test esi, esi
je 0x40590e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, esi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00405e90
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40594a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405940
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405940
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00435eb6
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407510
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects2C4631FF_5CC8_4EBC_A0DF_34C92291759E
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push reloc.SHLWAPI.dll_ParseURLW
push str.CtxIEInterceptorBHO
push 0
push eax
call fcn.00408b70
mov edi, eax
test edi, edi
js 0x4075ab
push 1
push str.NoExplorer
lea eax, [ebp - 0x20c]
push eax
call fcn.004085f0
mov edi, eax
test edi, edi
js 0x4075ab
push str.AppID
push ParseURLW
push str.CA6A1809_03CD_4711_8018_BB56B7A8499B
push 0
push str.AppIDIEInterceptor.DLL
call fcn.00408b70
mov edi, eax
test edi, edi
jns 0x4075cd
push str.AppIDIEInterceptor.DLL
push ParseURLW
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects2C4631FF_5CC8_4EBC_A0DF_34C92291759E
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0043624e
mov esp, ebp
pop ebp
ret 4
Function at 0x4078f0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x407904
mov eax, dword [edi]
mov esi, dword [ebp + 0xc]
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x407911
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
push str.update_url
push ebx
push eax
push 0
push ecx
call fcn.00408b70
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
js 0x407a59
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x407b12
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebp + 8], eax
or eax, edx
mov dword [ebp + 0xc], edx
je 0x407b12
test byte [ecx + 8], 2
je 0x407b12
cmp byte [ecx + 0xf], 9
jb 0x407b12
cmp dword [edi + 0x14], 8
jb 0x40796d
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x407975
mov esi, dword [esi]
mov ebx, str._NULL_
test edi, edi
je 0x4079cc
movzx eax, word [edi]
test ax, ax
je 0x4079b8
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407990
movzx eax, word [edi]
sub ecx, edx
sar ecx, 1
mov edx, ebx
test ax, ax
cmovne edx, edi
lea ecx, [ecx*2 + 2]
mov dword [ebp + 0x10], ecx
mov edi, ecx
jmp 0x4079d6
test ax, ax
mov dword [ebp + 0x10], 0xe
mov edx, ebx
cmovne edx, edi
mov edi, dword [ebp + 0x10]
jmp 0x4079d6
mov edi, 0xa
mov edx, str.NULL
test esi, esi
je 0x407a1f
movzx eax, word [esi]
test ax, ax
je 0x407a12
mov ecx, esi
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4079f0
sub ecx, dword [ebp + 0x10]
movzx eax, word [esi]
sar ecx, 1
test ax, ax
cmovne ebx, esi
lea ecx, [ecx*2 + 2]
jmp 0x407a29
test ax, ax
mov ecx, 0xe
cmovne ebx, esi
jmp 0x407a29
mov ecx, 0xa
mov ebx, str.NULL
push 0
push edi
push edx
push ecx
push ebx
push 0x15
push str.RegisterExtensionBHO
push 0x17
push 0x43d36c
push 0x2b
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041bd20
mov eax, dword [ebp - 4]
add esp, 0x30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x407a63
mov eax, dword [esi]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x407b12
mov edi, dword [ecx]
mov eax, edi
mov ebx, dword [ecx + 4]
or eax, ebx
je 0x407b12
test byte [ecx + 8], 2
je 0x407b12
cmp byte [ecx + 0xf], 9
jb 0x407b12
cmp dword [esi + 0x14], 8
jb 0x407aa0
mov esi, dword [esi]
test esi, esi
je 0x407aea
movzx edx, word [esi]
test dx, dx
je 0x407ad8
mov ecx, esi
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407ab4
sub ecx, dword [ebp + 0x10]
mov eax, str._NULL_
sar ecx, 1
test dx, dx
cmovne eax, esi
lea ecx, [ecx*2 + 2]
jmp 0x407af4
test dx, dx
mov eax, str._NULL_
mov ecx, 0xe
cmovne eax, esi
jmp 0x407af4
mov ecx, 0xa
mov eax, str.NULL
push 0
push ecx
push eax
push 0xe
push str.UnregisterBHO
push 0x18
push 0x43d36c
push 0x2b
push ebx
push edi
call fcn.0041bd20
add esp, 0x28
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4081c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4081d1
mov eax, dword [esi]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408297
push ebx
mov ebx, dword [ecx + 4]
push edi
mov edi, dword [ecx]
mov eax, edi
or eax, ebx
je 0x40828e
test byte [ecx + 8], 2
je 0x40828e
cmp byte [ecx + 0xf], 9
jb 0x40828e
cmp dword [esi + 0x14], 8
jb 0x408216
mov esi, dword [esi]
test esi, esi
je 0x408266
movzx edx, word [esi]
test dx, dx
je 0x408254
mov ecx, esi
lea eax, [ecx + 2]
mov dword [ebp + 0xc], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408230
sub ecx, dword [ebp + 0xc]
mov eax, str._NULL_
sar ecx, 1
test dx, dx
cmovne eax, esi
lea ecx, [ecx*2 + 2]
jmp 0x408270
test dx, dx
mov eax, str._NULL_
mov ecx, 0xe
cmovne eax, esi
jmp 0x408270
mov ecx, 0xa
mov eax, str.NULL
push 0
push ecx
push eax
push 0xe
push str.UnregisterBHO
push 0x18
push 0x43d36c
push 0x2b
push ebx
push edi
call fcn.0041bd20
add esp, 0x28
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x4082a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x4082b2
mov eax, dword [esi]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, eax
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40837f
mov edx, dword [ecx + 4]
push ebx
mov ebx, dword [ecx]
mov eax, ebx
or eax, edx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], edx
je 0x408376
test byte [ecx + 8], 2
je 0x408376
cmp byte [ecx + 0xf], 9
jb 0x408376
cmp dword [esi + 0x14], 8
jb 0x4082fe
mov esi, dword [esi]
test esi, esi
je 0x40834e
movzx edx, word [esi]
test dx, dx
je 0x408339
mov ecx, esi
lea ebx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408310
sub ecx, ebx
mov eax, str._NULL_
mov ebx, dword [ebp + 0xc]
sar ecx, 1
test dx, dx
mov edx, dword [ebp + 8]
cmovne eax, esi
lea ecx, [ecx*2 + 2]
jmp 0x408358
test dx, dx
mov eax, str._NULL_
mov edx, dword [ebp + 8]
mov ecx, 0xe
cmovne eax, esi
jmp 0x408358
mov ecx, 0xa
mov eax, str.NULL
push 0
push ecx
push eax
push 0x18
push str.UnregisterNativeMsgHost
push 0x1a
push 0x43d36c
push 0x2b
push edx
push ebx
call fcn.0041bd20
add esp, 0x28
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x40fd50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push edi
mov edi, dword [ebp + 8]
push 0x1fe
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x208], 0xff
lea eax, [ebp - 0x208]
xor bl, bl
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 2
push esi
push str.SOFTWAREPoliciesCitrixICA_clientEngineLockdown_ProfilesAll_RegionsLockdownVirtual_ChannelsControl
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0x204]
push 0x43f58c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
movzx ecx, bl
test eax, eax
mov edx, 1
cmove ecx, edx
mov al, cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043624e
mov esp, ebp
pop ebp
ret 8
Function at 0x4100b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43920d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], 4
push eax
push 0
push 0x10
push str.AllowBidirectionalContentRedirection
push str.SOFTWAREPoliciesCitrixICA_clientBidirectional_Content_Redirection
push ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
or esi, 0xffffffff
test eax, eax
je 0x4101d5
call fcn.00401a40
test al, al
je 0x4101d5
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x29], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push 2
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00401650
mov edx, dword [ebp - 0x14]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x410190
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x410186
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x410186
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00435eb6
add esp, 8
push 1
lea ecx, [ebp - 0x29]
mov dword [ebp - 0x18], 0
push ecx
push str.allowBidirectionalContentRedirection
mov dword [ebp - 0x14], 0xf
mov ecx, esi
mov byte [ebp - 0x28], 0
mov eax, dword [esi]
push str.ICA_Client_bidirectional_content_redirection
push 1
call dword [eax + 4]
mov esi, eax
test esi, esi
jne 0x4101d5
mov ecx, dword [ebp - 0x30]
mov eax, 1
cmp byte [ebp - 0x29], 0
cmovne ecx, eax
mov dword [ebp - 0x30], ecx
jmp 0x4101d8
mov ecx, dword [ebp - 0x30]
mov edx, dword [0x449ff8]
test edx, edx
je 0x41026b
mov edi, dword [edx]
mov eax, edi
mov ebx, dword [edx + 4]
or eax, ebx
je 0x41026b
test byte [edx + 8], 2
je 0x41026b
cmp byte [edx + 0xf], 9
jb 0x41026b
test ecx, ecx
mov dword [ebp - 0x38], esi
mov eax, 0x43f6c4
mov edx, 0x43f58c
cmove edx, eax
movzx eax, word [edx]
test ax, ax
je 0x410238
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410220
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x41023d
mov ecx, 0xe
movzx esi, word [edx]
mov eax, str._NULL_
push 0
push 4
test si, si
cmovne eax, edx
lea edx, [ebp - 0x38]
push edx
push ecx
push eax
push 0x39
push 0x43d7ec
push 0x2b
push ebx
push edi
call fcn.0041bd20
mov ecx, dword [ebp - 0x30]
add esp, 0x28
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret
Function at 0x4121d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
test eax, eax
je 0x4122c2
cmp dword [ebp + 0xc], esi
je 0x4122c2
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4122c2
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], esi
mov dword [ecx], esi
lea ecx, [ebp - 8]
push ecx
push 1
push esi
push eax
push ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4122b7
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x4122b7
cmp dword [ebp - 0xc], 1
jne 0x4122ab
mov eax, dword [ebp - 4]
test eax, eax
je 0x4122ae
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004362b5
mov esi, eax
add esp, 4
test esi, esi
je 0x4122ab
push dword [ebp - 4]
push edi
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x4122ab
push esi
call fcn.004362be
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
shr eax, 1
mov dword [ebx], esi
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x10