joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72a20252
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.72a218ab
cmp word [eax], 0xa
jne 0x72a202a9
mov esi, dword [eax + 8]
push esi
call fcn.72a0be99
cmp eax, 0x1b8
jne 0x72a20298
cmp esi, 0x800a01b8
jne 0x72a2029a
mov esi, eax
test esi, 0xffff8000
je 0x72a202b1
push 6
call fcn.72a0e22c
push eax
call fcn.72a20050
mov esi, eax
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov ax, si
pop edi
pop esi
leave
ret 4

Function at 0x72a202c1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.72a218ab
cmp word [eax], 0xa
jne 0x72a20318
mov esi, dword [eax + 8]
push esi
call fcn.72a0be99
cmp eax, 0x1b8
jne 0x72a20307
cmp esi, 0x800a01b8
jne 0x72a20309
mov esi, eax
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
push eax
call fcn.72a200a1
jmp 0x72a20307

Function at 0x72a20320
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.72a218ab
cmp word [eax], 0xa
jne 0x72a20382
push esi
mov esi, dword [eax + 8]
push esi
call fcn.72a0be99
cmp eax, 0x1b8
jne 0x72a20369
cmp esi, 0x800a01b8
mov dword [ebp + 8], esi
jne 0x72a2036c
mov dword [ebp + 8], eax
fild dword [ebp + 8]
pop esi
fstp dword [ebp + 8]
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
fld dword [ebp + 8]
pop edi
leave
ret 4
push eax
call fcn.72a20105
fstp dword [ebp + 8]
jmp 0x72a20373

Function at 0x72a2038d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x18], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.72a218ab
cmp word [eax], 0xa
jne 0x72a203ef
push esi
mov esi, dword [eax + 8]
push esi
call fcn.72a0be99
cmp eax, 0x1b8
jne 0x72a203d6
cmp esi, 0x800a01b8
mov dword [ebp + 8], esi
jne 0x72a203d9
mov dword [ebp + 8], eax
fild dword [ebp + 8]
pop esi
fstp qword [ebp - 8]
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
fld qword [ebp - 8]
pop edi
leave
ret 4
push eax
call fcn.72a20153
fstp qword [ebp - 8]
jmp 0x72a203e0
Function at 0x72a20426
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea ebx, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.72a218ab
cmp word [eax], 0xa
jne 0x72a2048b
mov esi, dword [eax + 8]
push esi
call fcn.72a0be99
cmp eax, 0x1b8
jne 0x72a2046d
cmp esi, 0x800a01b8
jne 0x72a2046f
mov esi, eax
push esi
call fcn.72a203fa
mov ecx, ebx
mov esi, eax
mov edi, edx
call sym.MSVBVM60.DLL___vbaFreeVar
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
push eax
call fcn.72a201a1
jmp 0x72a20475

Function at 0x72a206a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push ebx
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0x50
and word [ebp - 0x18], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.72a218ab
mov ebx, eax
cmp word [ebx], 0xa
jne 0x72a207ca
push edi
push esi
lea eax, [ebp - 0x8c]
push 0x64
push eax
push 0x729599f1
push 0x8dab
call fcn.72a1a2ca
mov edi, 0x72969578
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x8c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 8]
push ebx
call fcn.72a0be99
cmp eax, 0x1b8
jne 0x72a2073b
cmp ebx, 0x800a01b8
jne 0x72a2073d
mov ebx, eax
lea eax, [ebp - 4]
push eax
call fcn.72946557
push eax
push ebx
call fcn.72a21831
test eax, eax
je 0x72a20757
push eax
call fcn.72a0e22c
lea eax, [ebp - 0x170]
push 0x72
push eax
lea edi, [ebp - 0x8c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebp - 0x8c]
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp - 4]
lea eax, [ebp - 0x170]
push eax
call fcn.72a2bbb8
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x72a207b5
push 0xe
call fcn.72a0e22c
mov dword [ebp - 4], esi
pop esi
pop edi
mov ecx, dword [ebp - 8]
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
push ebx
call sym.MSVBVM60.DLL___vbaStrVarCopy
mov dword [ebp - 4], eax
jmp 0x72a207ba
Function at 0x72a207d5
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 0x50]
mov eax, dword [ebp + 8]
mov esi, 0xffffbfff
mov cx, word [eax]
movzx edx, cx
and edx, esi
cmp edx, 9
jne 0x72a2081d
mov eax, dword [eax + 8]
test ch, 0x40
je 0x72a2080c
mov eax, dword [eax]
push edi
xor ecx, ecx
push 3
push ecx
push ecx
push ecx
push ecx
push eax
call fcn.72a1955e
mov eax, edi
mov bx, word [eax]
movzx ecx, bx
and ecx, esi
cmp ecx, 2
jl 0x72a2083e
cmp ecx, 7
jle 0x72a20857
cmp ecx, 0xb
je 0x72a20857
cmp ecx, 0xe
je 0x72a20857
cmp ecx, 0x11
je 0x72a20857
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 5
push eax
push edi
call fcn.72a2151b
push eax
call fcn.72a193d1
mov eax, edi
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 8
push eax
push edi
call fcn.72a2151b
push eax
call fcn.72a193d1
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
cmp word [eax], 0x2d
je 0x72a20899
cmp bx, 7
je 0x72a20899
cmp bx, 0xb
je 0x72a20899
lea eax, [ebp - 4]
push eax
call fcn.72a21867
test eax, eax
je 0x72a20899
push eax
call fcn.72a0e22c
push 0
call fcn.72a10d44
movsx ax, byte [eax + 0xe]
push eax
push dword [ebp - 4]
call fcn.72a208bf
mov dword [ebp - 4], eax
and word [edi], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x72a20aec
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 0x50]
lea eax, [ebp - 0x20]
push eax
xor esi, esi
push dword [ebp + 0xc]
mov word [ebp - 0x20], si
call fcn.72a218ab
mov ecx, eax
mov word [ebp - 0x10], 2
mov dx, word [ecx]
movzx eax, dx
cmp eax, 0x11
ja case.0x72a20b2c.44
jmp dword [eax*4 + 0x72a20c54]
mov word [ebp - 0x10], 1
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret 8
xor al, al
cmp al, byte [ecx + 8]
sbb eax, eax
neg eax
mov word [ebp - 8], ax
jmp 0x72a20b39
mov cx, word [ecx + 8]
cmp cx, si
jl 0x72a20c0c
xor eax, eax
cmp cx, si
setg al
jmp 0x72a20b5b
mov ecx, dword [ecx + 8]
cmp ecx, esi
jl 0x72a20c0c
xor eax, eax
cmp ecx, esi
jmp 0x72a20b73
fld dword [ecx + 8]
fcomp qword [0x7295b568]
fnstsw ax
sahf
jb 0x72a20c0c
fld dword [ecx + 8]
fcomp qword [0x7295b568]
fnstsw ax
sahf
jbe case.0x72a20b2c.32
mov word [ebp - 8], 1
jmp 0x72a20b39
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x40]
push eax
push 5
lea eax, [ebp - 0x10]
push ecx
push eax
call fcn.72a2151b
push eax
call fcn.72a193d1
fld qword [ebp - 8]
fcomp qword [0x7295b568]
mov word [ebp - 0x10], 2
fnstsw ax
sahf
jb 0x72a20c0c
fld qword [ebp - 8]
fcomp qword [0x7295b568]
fnstsw ax
sahf
ja 0x72a20ba5
mov word [ebp - 8], si
jmp 0x72a20b39
fld qword [ecx + 8]
fcomp qword [0x7295b568]
fnstsw ax
sahf
jb 0x72a20c0c
fld qword [ecx + 8]
jmp 0x72a20bde
mov eax, dword [ecx + 0xc]
cmp eax, esi
jge 0x72a20c16
or word [ebp - 8], 0xffff
jmp 0x72a20b39
jne 0x72a20ba5
cmp dword [ecx + 8], esi
jne 0x72a20ba5
jmp case.0x72a20b2c.32
mov eax, dword [ecx + 0xc]
or eax, dword [ecx + 8]
or eax, dword [ecx + 4]
je case.0x72a20b2c.32
mov al, byte [ecx + 3]
and al, 0x80
neg al
sbb eax, eax
and al, 0xfe
inc eax
jmp 0x72a20b5b
test dh, 0x20
jne case.0x72a20b2c.41
cmp dx, 0x24
je case.0x72a20b2c.41
push 0x1ca
call fcn.72a0e22c
push 0xd
jmp 0x72a20c4b

Function at 0x72a20d49
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x50]
push dword [esp + 0x10]
push esi
call sym.MSVBVM60.DLL___vbaVarDateVar
mov eax, dword [esp + 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret 8
Function at 0x72a20dab
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea esi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.72a218ab
cmp word [eax], 0xa
jne 0x72a20df4
xor ecx, ecx
cmp dword [eax + 8], ecx
setge cl
dec ecx
mov edi, ecx
mov ecx, esi
call sym.MSVBVM60.DLL___vbaFreeVar
mov ax, di
pop edi
pop esi
leave
ret 4
push eax
call sym.MSVBVM60.DLL___vbaBoolVar
mov edi, eax
jmp 0x72a20de4

Function at 0x72a20dfe
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.72a218ab
cmp word [eax], 0xa
jne 0x72a20e68
push esi
mov esi, dword [eax + 8]
push esi
call fcn.72a0be99
cmp eax, 0x1b8
jne 0x72a20e47
cmp esi, 0x800a01b8
mov ebx, esi
jne 0x72a20e49
mov ebx, eax
test ebx, 0xffffff00
je 0x72a20e58
push 6
call fcn.72a0e22c
pop esi
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov al, bl
pop edi
pop ebx
leave
ret 4
push eax
call fcn.72a20022
mov bl, al
jmp 0x72a20e59

Function at 0x72a21290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 8
pop edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
add eax, 0x50
mov dword [ebp - 4], eax
mov esi, 0x4000
mov dx, word [ecx]
movzx eax, dx
and ah, 0xbf
dec eax
dec eax
je 0x72a21356
sub eax, 7
jne 0x72a212f2
test si, dx
je 0x72a212ed
mov eax, dword [ecx + 8]
mov ecx, dword [eax]
push dword [ebp - 4]
push 3
push 0
push 0
push 0
push 0
push ecx
call fcn.72a1955e
mov ecx, dword [ebp - 4]
jmp 0x72a212b5
mov ecx, dword [ecx + 8]
jmp 0x72a212d5
dec eax
dec eax
je 0x72a21356
sub eax, 6
je 0x72a21342
push ecx
call fcn.72a200a1
lea edx, [ebp - 4]
mov cl, al
and cl, 0xf
movsx cx, cl
add ecx, 0x30
cmp cx, 0x39
jbe 0x72a21319
add ecx, 7
dec edi
dec edx
dec edx
shr eax, 4
mov word [edx], cx
jne 0x72a21304
push 8
pop eax
sub eax, edi
push eax
lea eax, [ebp + edi*2 - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
jne 0x72a21371
push 0xe
call fcn.72a0e22c
test si, dx
je 0x72a21351
mov eax, dword [ecx + 8]
mov cl, byte [eax]
movzx eax, cl
jmp 0x72a21301
mov cl, byte [ecx + 8]
jmp 0x72a2134c
test si, dx
je 0x72a2136b
mov eax, dword [ecx + 8]
mov cx, word [eax]
and ecx, 0xffff
mov eax, ecx
jmp 0x72a21301
mov cx, word [ecx + 8]
jmp 0x72a21361
mov ecx, dword [ebp - 4]
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x72a213bb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0xc
pop edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
add eax, 0x50
mov dword [ebp - 4], eax
mov esi, 0x4000
mov dx, word [ecx]
movzx eax, dx
and ah, 0xbf
dec eax
dec eax
je 0x72a21478
sub eax, 7
jne 0x72a2141d
test si, dx
je 0x72a21418
mov eax, dword [ecx + 8]
mov ecx, dword [eax]
push dword [ebp - 4]
push 3
push 0
push 0
push 0
push 0
push ecx
call fcn.72a1955e
mov ecx, dword [ebp - 4]
jmp 0x72a213e0
mov ecx, dword [ecx + 8]
jmp 0x72a21400
dec eax
dec eax
je 0x72a21478
sub eax, 6
je 0x72a21464
push ecx
call fcn.72a200a1
lea ecx, [ebp - 4]
mov dl, al
dec edi
and dl, 7
dec ecx
movsx dx, dl
dec ecx
add edx, 0x30
shr eax, 3
mov word [ecx], dx
jne 0x72a2142f
push 0xc
pop eax
sub eax, edi
push eax
lea eax, [ebp + edi*2 - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
jne 0x72a21493
push 0xe
call fcn.72a0e22c
test si, dx
je 0x72a21473
mov eax, dword [ecx + 8]
mov cl, byte [eax]
movzx eax, cl
jmp 0x72a2142c
mov cl, byte [ecx + 8]
jmp 0x72a2146e
test si, dx
je 0x72a2148d
mov eax, dword [ecx + 8]
mov cx, word [eax]
and ecx, 0xffff
mov eax, ecx
jmp 0x72a2142c
mov cx, word [ecx + 8]
jmp 0x72a21483
mov ecx, dword [ebp - 4]
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x72a2203f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x72a4ee5c], esi
je 0x72a2216b
push dword [ebp + 0xc]
call fcn.72a2b57a
mov edi, eax
pop ecx
inc edi
push 1
lea ecx, [ebp - 0x94]
push esi
lea eax, [edi + edi]
push ecx
push eax
push esi
push 0x78
lea ecx, [ebp - 0x10]
call fcn.72a118ff
mov ecx, dword [ebp - 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp ecx, esi
mov dword [ebp - 4], ecx
je 0x72a2209d
push esi
lea eax, [edi + edi]
push esi
push eax
push ecx
push edi
push dword [ebp + 0xc]
push esi
push esi
call ebx
cmp dword [ebp - 4], esi
je 0x72a22115
mov eax, dword [ebp + 0x14]
cmp eax, esi
jbe 0x72a22163
cmp eax, 2
jbe 0x72a220bb
cmp eax, 7
jne 0x72a22163
mov edi, dword [ebp + 0x1c]
cmp edi, esi
jne 0x72a220da
push esi
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x72a22157
push esi
push esi
shr edi, 1
push esi
push esi
push edi
push dword [ebp + 0x18]
push esi
push esi
call ebx
mov dword [ebp + 0xc], eax
push 1
lea eax, [ebp - 0x10c]
push esi
push eax
lea ecx, [ebp - 0x1c]
push dword [ebp + 0x1c]
push esi
push 0x78
call fcn.72a118ff
mov eax, dword [ebp - 0x18]
cmp eax, esi
mov dword [ebp + 0x1c], eax
jne 0x72a22127
lea ecx, [ebp - 0x1c]
call fcn.72a11955
lea ecx, [ebp - 0x10]
call fcn.72a11955
push 0xe
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x18
push esi
push esi
push dword [ebp + 0xc]
push eax
push edi
push dword [ebp + 0x18]
push esi
push esi
call ebx
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.72a11955
lea ecx, [ebp - 0x10]
call fcn.72a11955
mov eax, esi
jmp 0x72a22120
push dword [ebp + 0x1c]
jmp 0x72a220c3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x72a22120

Function at 0x72a221e4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
cmp dword [0x72a4ee5c], eax
je 0x72a22234
cmp dword [ebp + 0xc], eax
push eax
je 0x72a22229
push eax
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x72a22222
push 0xe
pop eax
leave
ret 8
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x72a2221e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x72a2221e
Function at 0x72a22242
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x72a4ee5c], esi
je 0x72a222c6
push dword [ebp + 0xc]
call fcn.72a2b57a
pop ecx
lea edi, [eax + eax + 2]
push 1
lea eax, [ebp - 0x84]
push esi
push eax
push edi
push esi
push 0x78
lea ecx, [ebp - 0xc]
call fcn.72a118ff
mov ebx, dword [ebp - 8]
cmp ebx, esi
jne 0x72a22294
lea ecx, [ebp - 0xc]
call fcn.72a11955
push 0xe
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
push esi
push esi
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x72a222b8
push 0xe
pop esi
lea ecx, [ebp - 0xc]
call fcn.72a11955
mov eax, esi
jmp 0x72a2228d
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
jmp 0x72a222ac
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x72a2228d

Function at 0x72a222d4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x72a4ee5c], edi
je 0x72a2235e
mov ebx, dword [ebp + 0x14]
push 1
lea eax, [ebp - 0x84]
push edi
lea esi, [ebx + ebx]
push eax
push esi
push edi
push 0x78
lea ecx, [ebp - 0xc]
call fcn.72a118ff
mov eax, dword [ebp - 8]
cmp eax, edi
mov dword [ebp + 0x14], eax
jne 0x72a22324
lea ecx, [ebp - 0xc]
call fcn.72a11955
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
cmp esi, edi
jne 0x72a22352
push ebx
push dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [ebp + 0x14]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x72a22352
mov esi, 0x8007000e
lea ecx, [ebp - 0xc]
call fcn.72a11955
mov eax, esi
jmp 0x72a2231d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x72a2231d
Function at 0x72a247df
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
cmp dword [eax], 0xc00000fd
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 0xc]
jne 0x72a24811
test byte [eax + 4], 6
jne 0x72a24811
push dword [0x72a4ef9c]
call ebx
lea ecx, [ebp - 4]
mov dword [eax + 0x44], ecx
mov eax, dword [edi + 8]
cmp eax, edi
ja 0x72a24916
lea ecx, [ebp - 4]
cmp eax, ecx
jb 0x72a24916
test esi, esi
je 0x72a24916
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x72a24916
mov ax, word [esi + 2]
cmp ax, 4
jb 0x72a24916
cmp ax, 0x14
ja 0x72a24916
mov ecx, dword [ebp + 8]
test byte [ecx + 4], 6
je 0x72a24875
push 1
pop ebx
push ebx
push ebx
push ebx
push esi
push edi
call fcn.72a24a82
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
mov ax, word [esi]
test al, 0x30
je 0x72a24888
cmp dword [edi + 0x14], 0
je 0x72a24888
test byte [edi + 0x10], 2
je 0x72a24890
test al, 1
je 0x72a24916
push ecx
call fcn.72a24c97
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.72a24c5c
test eax, eax
je 0x72a24916
cmp dword [ebp + 0xc], 0
je 0x72a248b0
test byte [esi], 1
je 0x72a24916
push edi
call fcn.72a43c8e
call fcn.72a0e2a7
xor eax, eax
cmp dword [ebp + 0xc], eax
jne 0x72a24986
test byte [esi], 0x30
je 0x72a2493f
cmp dword [edi + 0x14], eax
je 0x72a2493f
test byte [edi + 0x10], 2
jne 0x72a2493f
push eax
push 1
push eax
push esi
push edi
call fcn.72a24a82
test byte [esi], 0x40
push dword [0x72a4ef9c]
je 0x72a2491e
call ebx
mov ecx, dword [edi + 0x1c]
mov edx, dword [esi + 0x18]
movzx ecx, word [edx + ecx*2 + 2]
mov dword [eax + 0x98], ecx
mov eax, dword [edi + 0x14]
cmp eax, 0xfffffffe
je 0x72a24934
cmp eax, 0xffffffff
je 0x72a24929
test eax, eax
je 0x72a24916
push edi
call fcn.72a24bc8
push 1
pop eax
jmp 0x72a24870
call ebx
and dword [eax + 0x98], 0
jmp 0x72a248ff
push dword [edi + 0x1c]
push edi
call fcn.72a24b73
jmp 0x72a24916
push dword [edi + 0x1c]
push edi
call fcn.72a24b9e
jmp 0x72a24916
cmp dword [ebp + 0xc], eax
jne 0x72a24986
test byte [edi + 0x10], 1
je 0x72a24986
test byte [esi], 0x80
jne 0x72a24986
push dword [0x72a4ef9c]
call ebx
push eax
call fcn.7294a203
push eax
call fcn.72a0e86e
push eax
push 0x13
call fcn.7294b091
push dword [0x72a4ef9c]
call ebx
add eax, 0x78
push eax
call fcn.72a0c6b6
push 0x9c68
call fcn.72a0e22c
push 1
push 1
push eax
push esi
push edi
call fcn.72a24a82
push edi
call fcn.72a24c31
jmp 0x72a24916

Function at 0x72a2499d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and dword [eax + 0x98], 0
add eax, 0x78
push eax
call fcn.7294e4c8
mov eax, dword fs:[0]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0xfffffffd
jne 0x72a249d9
mov eax, dword [ebp - 4]
and dword [eax + 0x10], 0xfffffffd
leave
ret 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
jmp 0x72a249d5
Function at 0x72a249e1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov eax, dword fs:[0]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
and dword [edi + 0x98], 0
test byte [esi + 0x10], 2
jne 0x72a24a15
push 0x14
call fcn.72a0e22c
add edi, 0x78
push edi
call fcn.7294e4c8
and dword [esi + 0x10], 0xfffffffd
cmp dword [ebp + 8], 0xfffffffe
je 0x72a24a3d
cmp dword [ebp + 8], 0xffffffff
jne 0x72a24a37
push dword [esi + 0x18]
push esi
call fcn.72a24b73
pop edi
pop esi
leave
ret 4
push dword [esi + 0x18]
push esi
call fcn.72a24b9e
jmp 0x72a24a37

Function at 0x72a24a48
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword fs:[0]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test byte [esi + 0x10], 2
je 0x72a24a7b
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and dword [eax + 0x98], 0
add eax, 0x78
push eax
call fcn.7294e4c8
and dword [esi + 0x10], 0
pop esi
leave
ret

Function at 0x72a24c97
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax], 0xc000008f
jne 0x72a24cd6
cmp dword [eax + 0x10], 2
jne 0x72a24cd6
mov ecx, 0xdeadcafe
cmp dword [eax + 0x14], ecx
jne 0x72a24cd6
cmp dword [eax + 0x18], ecx
jne 0x72a24cd6
push dword [0x72a4ef9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0x94], 0x800a9c68
jne 0x72a24cd6
push 1
pop eax
ret 4
xor eax, eax
jmp 0x72a24cd3