joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x9c
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0xa4]
mov dword [ebx], edi
push ebx
push 0x20106
push edi
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10004093
mov esi, eax
push 2
call fcn.1000f952
add esp, 4
test al, al
je 0x1000407a
lea edi, [ebp - 0xa4]
mov ecx, edi
push 2
push 0x1f3
push str....._third_partyie_to_edge_bho_bho.cc
call fcn.1000f99c
mov ecx, edi
call fcn.10002820
push 0x22
push str.Failed_to_open_kStateKey_reg_key:
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, eax
push esi
call fcn.10001bb0
mov ecx, edi
call fcn.1000fcf8
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0xa4]
xor eax, eax
dec eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
mov dword [ebp - 0xa4], 4
push ebx
push ecx
push esi
push edi
push str.DisableNeedEdgeForEnterprise
mov dword [ebp - 0xa8], edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esi], 4
mov ebx, 0xd
cmove ebx, edi
test eax, eax
cmovne ebx, eax
cmp ebx, 2
je 0x100040e5
test ebx, ebx
jne 0x100040fe
cmp dword [ebp - 0x18], 1
je 0x100040fa
xor ebx, ebx
mov eax, dword [ebp - 0xa8]
test eax, eax
je 0x1000407c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000407c
mov bl, 1
jmp 0x100040e7
push 2
call fcn.1000f952
add esp, 4
test al, al
je 0x100040e5
lea edi, [ebp - 0xa4]
mov ecx, edi
push 2
push 0x1ef
push str....._third_partyie_to_edge_bho_bho.cc
call fcn.1000f99c
mov ecx, edi
call fcn.10002820
push 0x38
push str.Failed_to_read_kDisableNeedEdgeForEnterprise_reg_value:
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, eax
push ebx
call fcn.10001bb0
mov ecx, edi
call fcn.1000fcf8
jmp 0x100040e5
Function at 0x100044d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
mov ebx, 0xfffffff8
xor esi, esi
jmp 0x10004528
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.NotifyDisableIEOptions
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004523
cmp dword [ebp - 0x18], 4
je 0x10004566
add ebx, 4
je 0x1000456a
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebx + str.SOFTWAREPoliciesMicrosoftInternet_ExplorerMain]
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x14]
push ecx
push 0x20106
push edi
push str.SOFTWAREPoliciesMicrosoftInternet_ExplorerMain
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004523
test esi, esi
je 0x100044ee
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
test eax, eax
jne 0x10004523
jmp 0x100044f1
mov bl, 1
jmp 0x1000456c
xor ebx, ebx
test esi, esi
je 0x10004577
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10006944
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x98
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0xa4]
mov dword [ebx], edi
push ebx
push 0x20119
push edi
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10006a0f
mov esi, eax
push 2
call fcn.1000f952
add esp, 4
test al, al
je 0x100069cc
mov ecx, ebx
push 2
push 0xc2
push str....._third_partyie_to_edge_bhocampaign_util.cc
call fcn.1000f99c
mov ecx, ebx
call fcn.10002820
push 0x22
push str.Failed_to_open_kStateKey_reg_key:
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, eax
push esi
call fcn.10001bb0
mov ecx, ebx
call fcn.1000fcf8
lea eax, [ebp - 0xa4]
mov bl, byte [ebp + 0xc]
mov dword [ebp - 0xa4], 0xffffffff
push eax
push str.CampaignMode
call fcn.1000e7ef
add esp, 8
mov ecx, dword [ebp - 0xa4]
xor edx, edx
inc edx
cmp ecx, 4
cmovae ecx, edx
test eax, eax
cmovne ecx, edx
jmp dword [ecx*4 + 0x1005e358]
not bl
and bl, byte [ebp + 8]
jmp 0x10006a72
mov edi, dword [ebp - 0xa4]
xor eax, eax
dec eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
mov dword [ebp - 0xa4], 4
xor eax, eax
push ebx
push ecx
push esi
push eax
xor ebx, ebx
push str.DisableCampaignRedirect
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esi], 4
mov esi, 0xd
cmove esi, ebx
test eax, eax
cmovne esi, eax
cmp esi, 2
je 0x100069cc
test esi, esi
jne 0x10006a94
cmp dword [ebp - 0x18], 1
jne 0x100069cc
xor ebx, ebx
jmp 0x10006a72
xor bl, 1
test edi, edi
je 0x10006a7d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.1000f952
add esp, 4
test al, al
je 0x100069cc
lea ebx, [ebp - 0xa4]
mov ecx, ebx
push 2
push 0xbe
push str....._third_partyie_to_edge_bhocampaign_util.cc
call fcn.1000f99c
mov ecx, ebx
call fcn.10002820
push 0x33
push str.Failed_to_read_kDisableCampaignRedirect_reg_value:
jmp 0x100069b4
Function at 0x100082b2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2a4
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x218]
push 0x208
push 0
push ebx
call fcn.1002ef60
add esp, 0xc
push 0x104
push ebx
call fcn.1000dc17
add esp, 8
test eax, eax
js 0x10008441
mov eax, dword [ebp + 8]
xor ecx, ecx
dec ecx
lea esi, [ebp - 0x2b0]
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
push eax
push esi
call fcn.100084a8
push 0
call fcn.1000f952
add esp, 4
test al, al
je 0x1000839a
lea edi, [ebp - 0x2a4]
mov ecx, edi
push 0
push 0x42
push str....._third_partyie_to_edge_bhoie_to_edge_core.cc
call fcn.1000f99c
mov ecx, edi
call fcn.10002820
push str.InvokeEdge:
push eax
call fcn.10003222
add esp, 8
mov edi, eax
push ebx
call fcn.100419e7
add esp, 4
push eax
push ebx
push edi
call fcn.100065e4
add esp, 0xc
push 0x1005e481
push eax
call fcn.10003222
add esp, 8
lea ecx, [ebp - 0x2b0]
movzx edx, byte [ecx + 0xb]
mov edi, edx
and edi, 0x7f
test dl, dl
cmovs edi, dword [ecx + 4]
cmovs ecx, dword [ecx]
push edi
push ecx
push eax
call fcn.100065e4
add esp, 0xc
lea ecx, [ebp - 0x2a4]
call fcn.1000fcf8
cmp byte [ebp - 0x2a5], 0
jns 0x100083a9
mov esi, dword [ebp - 0x2b0]
xor eax, eax
push 1
push eax
push esi
push ebx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
setae bl
jae 0x10008428
mov edi, eax
push 2
call fcn.1000f952
add esp, 4
test al, al
je 0x10008428
lea esi, [ebp - 0x2a4]
mov ecx, esi
push 2
push 0x47
push str....._third_partyie_to_edge_bhoie_to_edge_core.cc
call fcn.1000f99c
mov ecx, esi
call fcn.10002820
push str.Could_not_start_Edge__Error:
push eax
call fcn.10003222
add esp, 8
mov ecx, eax
push edi
call fcn.100021e0
push 0x1005e481
push eax
call fcn.10003222
add esp, 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
push eax
call fcn.10001dc0
mov ecx, esi
call fcn.1000fcf8
cmp byte [ebp - 0x2a5], 0
jns 0x1000848f
push dword [ebp - 0x2b0]
call fcn.1002b2c4
add esp, 4
jmp 0x1000848f
mov esi, eax
push 2
call fcn.1000f952
add esp, 4
test al, al
je 0x1000848d
lea edi, [ebp - 0x2a4]
mov ecx, edi
push 2
push 0x3c
push str....._third_partyie_to_edge_bhoie_to_edge_core.cc
call fcn.1000f99c
mov ecx, edi
call fcn.10002820
push 0x25
push str.Failed_to_get_current_stub_location:
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, eax
push esi
call fcn.10001bb0
mov ecx, edi
call fcn.1000fcf8
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
add esp, 0x2a4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10009028
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov esi, ecx
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
push 0
call fcn.1000f952
add esp, 4
cmp edi, ebx
je 0x100090cc
test al, al
je 0x1000908b
lea edi, [ebp - 0x9c]
mov ecx, edi
push 0
push 0x3a
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f99c
mov ecx, edi
call fcn.10002820
push 0x1c
push str.RepeatingTaskScheduler_Start
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, edi
call fcn.1000fcf8
sub esp, 0x10
movaps xmm0, xmmword [0x1005e550]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x14], eax
xor eax, eax
push eax
push eax
push esi
push 0x10009110
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
test al, al
je 0x100090b7
lea esi, [ebp - 0x9c]
mov ecx, esi
push 0
push 0x36
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f99c
mov ecx, esi
call fcn.10002820
push 0x25
push str.No_tasks__skipping_scheduler_creation
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, esi
call fcn.1000fcf8
jmp 0x100090b7
Function at 0x1000b424
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x270
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x218]
push 0x208
push 0
push ebx
call fcn.1002ef60
add esp, 0xc
push 0x104
push ebx
call fcn.1000dc17
add esp, 8
test eax, eax
js 0x1000b569
mov edi, dword [ebp + 8]
push ebx
call fcn.100419e7
add esp, 4
add eax, 0x28
xor ecx, ecx
dec ecx
lea esi, [ebp - 0x224]
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov ecx, esi
push eax
call fcn.1000b5be
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
sar ecx, 1
push edi
push ebx
push str.__s____create_cache_container_d
push ecx
push eax
call fcn.1000b62f
add esp, 0x14
test eax, eax
js 0x1000b56d
xorps xmm0, xmm0
lea eax, [ebp - 0x268]
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
lea ecx, [ebp - 0x278]
movups xmmword [ecx], xmm0
mov edx, dword [ebp - 0x224]
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000b571
push 0xffffffffffffffff
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000b587
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call ebx
push dword [ebp - 0x278]
call ebx
lea ecx, [ebp - 0x268]
mov dword [ecx], esi
call fcn.10007c66
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, edi
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, eax
jmp 0x1000b552
mov edi, eax
jmp 0x1000b545
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1000b545
lea eax, [ebp - 0x27c]
mov dword [eax], 0xffffffff
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1000b51b
mov eax, dword [ebp - 0x27c]
test eax, eax
mov edi, 0x80004005
cmove edi, eax
jmp 0x1000b52f
Function at 0x1000b6bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1006800c]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
mov esi, 0x80070057
cmp eax, 0x104
jb 0x1000b738
lea esi, [ebp - 0x20]
mov dword [esi], 0xffffffff
call fcn.1000e3a2
mov ecx, 0x10055050
mov edx, 0x10055060
test al, al
cmovne edx, ecx
movups xmm0, xmmword [edx]
lea eax, [ebp - 0x1c]
movups xmmword [eax], xmm0
xor edi, edi
push esi
push edi
push edi
push eax
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, eax
test eax, eax
jne 0x1000b738
push dword [ebp + 8]
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
mov eax, 0x80004005
cmove edi, eax
push dword [ebp - 0x20]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, edi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002bd4a
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
Function at 0x1000e076
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x11c
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1006aa08]
mov ecx, dword [0x10069d98]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000e0c6
mov bl, byte [0x1006aa04]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
add esp, 0x11c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1006aa08
call fcn.1002b337
add esp, 4
cmp dword [0x1006aa08], 0xffffffff
jne 0x1000e0a9
mov eax, dword [0x1006aa38]
mov ecx, dword [0x10069d98]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000e1fc
mov bl, 1
cmp byte [0x1006aa34], 0
je 0x1000e11d
mov byte [0x1006aa04], bl
push 0x1006aa08
call fcn.1002b3ad
add esp, 4
jmp 0x1000e0a9
mov eax, dword [0x1006aa40]
mov ecx, dword [0x10069d98]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000e239
cmp byte [0x1006aa3c], 0
jne 0x1000e108
lea esi, [ebp - 0x120]
push 0x110
push 0
push esi
call fcn.1002ef60
add esp, 0xc
mov dword [esi - 4], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x1000e108
lea eax, [ebp - 0x128]
mov dword [eax], ebx
push eax
push ebx
push ebx
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
test eax, eax
je 0x1000e108
mov eax, dword [ebp - 0x120]
cmp eax, 0xa
je 0x1000e1b3
cmp eax, 6
je 0x1000e1b3
xor ebx, ebx
jmp 0x1000e108
mov bl, 1
mov eax, dword [ebp - 0x128]
cmp eax, 0x1b
ja 0x1000e1ce
mov ecx, 0xa07f7d0
bt ecx, eax
jb 0x1000e108
lea ecx, [eax - 0x77]
cmp ecx, 0xb
ja 0x1000e1e4
mov edx, 0xccd
bt edx, ecx
jb 0x1000e108
add eax, 0xffffffba
cmp eax, 0xe
ja 0x1000e1ac
mov ecx, 0x4005
bt ecx, eax
jb 0x1000e108
jmp 0x1000e1ac
push 0x1006aa38
call fcn.1002b337
add esp, 4
cmp dword [0x1006aa38], 0xffffffff
jne 0x1000e0fd
push 0x1c
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
setne byte [0x1006aa34]
push 0x1006aa38
call fcn.1002b3ad
add esp, 4
jmp 0x1000e0fd
push 0x1006aa40
call fcn.1002b337
add esp, 4
cmp dword [0x1006aa40], 0xffffffff
jne 0x1000e13e
xor eax, eax
mov dword [ebp - 0x124], eax
push 0x1100
push eax
push str.MDMRegistration.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x1000e29c
push str.IsDeviceRegisteredWithManagement
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e29c
mov ecx, eax
call dword [section..00cfg]
xor esi, esi
lea edi, [ebp - 0x124]
push esi
push esi
push edi
call ecx
cmp dword [edi], esi
setne cl
jmp 0x1000e2b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
xor ecx, ecx
test eax, eax
setns al
and al, cl
mov byte [0x1006aa3c], al
push 0x1006aa40
call fcn.1002b3ad
add esp, 4
jmp 0x1000e13e
Function at 0x1000e4fb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.SCODEF
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x1000e56c
mov edi, eax
mov dword [ebp - 0x14], 0
push str.msiso.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e5b3
mov ecx, 0x82
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000e56c
mov ecx, eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], 0
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push ebx
push eax
push edi
call ecx
test eax, eax
je 0x1000e5ae
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
je 0x1000e5cc
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1000e5cc
mov edi, eax
xor eax, eax
dec eax
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
push ecx
push ecx
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
setne bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000e5ce
mov eax, dword [ebp - 0x14]
jmp 0x1000e572
push str.iertutil.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e56c
mov ecx, 0x1e0
jmp 0x1000e543
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000e5e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [esp + 0x20], eax
xor edi, edi
dec edi
lea esi, [esp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov ecx, esi
call fcn.1000e4fb
mov bl, 1
test al, al
je 0x1000e637
xor eax, eax
lea ebx, [esp + 0x10]
mov dword [ebx], eax
push ebx
push 0x20119
push eax
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000e659
xor ebx, ebx
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
je 0x1000e635
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000e635
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
lea eax, [esp + 0x1c]
mov dword [eax], edi
mov edi, esp
mov dword [edi], 8
push edi
push ebx
mov ebx, ecx
push eax
push 0
push str.LatestUpsellAttemptedSessionTime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e64c
cmp dword [esp + 0x1c], 0xb
jne 0x1000e64c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
test ebx, ebx
je 0x1000e6ab
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
setns bl
jmp 0x1000e637
Function at 0x1000e6bd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [esp + 0x20], eax
xor ebx, ebx
call fcn.1000e5e2
test al, al
jne 0x1000e76b
lea ecx, [esp + 0xc]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
sub esp, 0x1c
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x1005f300]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysStringLen
call fcn.100043cc
mov ebx, 0
test eax, eax
jne 0x1000e75c
xor eax, eax
dec eax
lea ecx, [esp + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
call fcn.1000e4fb
test al, al
je 0x1000e75a
movsd xmm0, qword [esp + 4]
lea eax, [esp + 0x18]
movsd qword [eax], xmm0
push 8
push eax
push 0xb
push 0
push str.LatestUpsellAttemptedSessionTime
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000e77e
xor ebx, ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1000e76b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x1000e75c

Function at 0x1000e809
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
mov dword [edi], esi
push edi
push 0x20119
push esi
push str.SoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e864
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push edi
push dword [ebp + 8]
push eax
push 0
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
jne 0x1000e88d
xor eax, eax
mov dword [ebp - 0x14], eax
push edi
push 0x20119
push eax
push str.SoftwareMicrosoftEdgeIEToEdge
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000e8cf
mov ebx, eax
mov edi, dword [ebp - 0x18]
test esi, esi
je 0x1000e89b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, dword [ebp - 0x20]
mov ecx, 0x65e
cmove ecx, eax
test ebx, ebx
cmovne ecx, ebx
movzx esi, cx
or esi, 0x80070000
test ecx, ecx
cmovle esi, ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push edi
push dword [ebp + 8]
push eax
push 0
push dword [ebp - 0x1c]
mov edi, ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test edi, edi
je 0x1000e88d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000e88d