joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68922bc0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0xc], 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 0
call sym.kernelbase.dll_LocalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x68922bfb
push 0xc000009a
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68922d25
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x12
call dword [sym.imp.ntext.dll_NtQuerySystemInformation]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x68922c1a
jmp 0x68922c69
mov ecx, dword [ebp - 0x14]
push ecx
call sym.kernelbase.dll_LocalFree
cmp dword [ebp - 0x18], 0xc0000004
je 0x68922c43
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x68922d25
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
ja 0x68922c56
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
jmp 0x68922c5c
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, 1
test eax, eax
jne 0x68922bcf
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0x18
jae 0x68922c7a
jmp 0x68922d17
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0x14
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x1c], ecx
push 0x3a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
call sub.ntext.dll_wcschr
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x68922ce0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp edx, dword [ecx + 0x14]
je 0x68922ce0
mov eax, dword [ebp - 0x10]
sub eax, 2
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x68922cf2
mov edx, dword [ebp - 4]
mov eax, dword [edx]
cmp eax, dword [ebp - 8]
jbe 0x68922cf4
jmp 0x68922d17
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
sub edx, dword [ecx]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, 1
test edx, edx
jne 0x68922c6f
mov eax, dword [ebp - 0x14]
push eax
call sym.kernelbase.dll_LocalFree
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x68922f50
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68952b58
push 0x68933e0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x28], 0x7fff
mov eax, dword [ebp - 0x28]
push eax
push 0
call sym.kernelbase.dll_LocalAlloc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x68922f9a
xor eax, eax
jmp 0x689230bd
push 0
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 5
call dword [sym.imp.ntext.dll_NtQuerySystemInformation]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xc0000004
jne 0x68922fcf
mov eax, dword [ebp - 0x1c]
push eax
call sym.kernelbase.dll_LocalFree
mov ecx, dword [ebp - 0x28]
add ecx, 0x7fff
mov dword [ebp - 0x28], ecx
jmp 0x68922fd1
jmp 0x68922fda
mov edx, 1
test edx, edx
jne 0x68922f7f
cmp dword [ebp - 0x2c], 0
jge 0x68923000
mov eax, dword [ebp - 0x1c]
push eax
call sym.kernelbase.dll_LocalFree
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x689230bd
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
shr eax, 2
cmp dword [ebp - 0x24], eax
jae 0x68923037
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x44]
mov dword [edx + ecx*4], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
cmp dword [edx], 0
jne 0x68923041
jmp 0x68923055
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, 1
test edx, edx
jne 0x68923014
mov eax, dword [ebp - 0x24]
shl eax, 2
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x689230af
mov ecx, dword [ebp - 0x1c]
push ecx
call sym.kernelbase.dll_LocalFree
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x689230e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
push esi
push edi
mov dword [ebp - 0xc], 0x474
mov eax, dword [ebp - 0xc]
push eax
push 0
call sym.kernelbase.dll_LocalAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x68923119
push 0x5aa
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x689232c7
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push 0xb
call dword [sym.imp.ntext.dll_NtQuerySystemInformation]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x6892322e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
push eax
call sym.kernelbase.dll_LocalFree
cmp dword [ebp - 0x14], 0xc0000004
je 0x6892316b
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x689232c7
cmp dword [ebp - 0xc], 0x120
jae 0x68923191
push 0
push 0x5b
push 0x6893be68
push str.Size___sizeof_RTL_PROCESS_MODULES_
call dword [sym.imp.ntext.dll_RtlAssert]
mov dword [ebp - 0x20], 0
jmp 0x68923198
mov dword [ebp - 0x20], 1
mov edx, dword [ebp - 8]
imul edx, edx, 0x11c
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x120
jae 0x689231d3
push 0
push 0x5e
push 0x6893be68
push str.NewSize___sizeof_RTL_PROCESS_MODULES_
call dword [sym.imp.ntext.dll_RtlAssert]
mov dword [ebp - 0x18], 0
jmp 0x689231da
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x68923226
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
ja 0x68923207
push 0
push 0x62
push 0x6893be68
push str.NewSize___Size
call dword [sym.imp.ntext.dll_RtlAssert]
mov dword [ebp - 0x1c], 0
jmp 0x6892320e
mov dword [ebp - 0x1c], 1
push 0xc0000004
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x689232c7
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x689232a8
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
jne 0x68923238
jmp 0x689232b5
mov dword [ebp - 0x10], 0
jmp 0x6892324a
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jae 0x689232a6
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x11c
mov eax, dword [ebp - 4]
lea esi, [eax + edx + 4]
mov ecx, 0x47
lea edi, [ebp - 0x13c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp + 8]
jne 0x689232a4
push 0x11c
lea edx, [ebp - 0x13c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.ntext.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call sym.kernelbase.dll_LocalFree
mov eax, 1
jmp 0x689232c7
jmp 0x68923241
jmp 0x689232b5
mov edx, 1
test edx, edx
jne 0x689230f4
mov eax, dword [ebp - 4]
push eax
call sym.kernelbase.dll_LocalFree
push 6
call sub.kernel32.dll_SetLastError
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x689236b0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.GetMappedFileNameA__p___p___p___lu__n
call sub.ntext.dll_DbgPrint
add esp, 0x14
mov ecx, dword [ebp + 0x14]
shl ecx, 1
push ecx
push 0
call sym.kernelbase.dll_LocalAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x689236ef
xor eax, eax
jmp 0x68923754
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.kernelbase.dll_K32GetMappedFileNameW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x14]
jae 0x6892371a
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x68923720
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
call sub.kernel32.dll_WideCharToMultiByte
test eax, eax
jne 0x68923748
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
push ecx
call sym.kernelbase.dll_LocalFree
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x68923760
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.GetMappedFileNameW__p___p___p___lu__n
call sub.ntext.dll_DbgPrint
add esp, 0x14
cmp dword [ebp + 0x14], 0
jne 0x6892379c
push 0x7a
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x6892383d
lea ecx, [ebp - 4]
push ecx
push 0x210
lea edx, [ebp - 0x21c]
push edx
push 2
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntext.dll_NtQueryVirtualMemory]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x689237d9
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x6892383d
movzx eax, word [ebp - 0x21c]
shr eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 1
cmp edx, dword [ebp + 0x14]
jbe 0x6892380e
mov eax, dword [ebp + 0x14]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 4], ecx
push 0x7a
call sub.kernel32.dll_SetLastError
jmp 0x68923815
push 0
call sub.kernel32.dll_SetLastError
mov edx, dword [ebp - 8]
shl edx, 1
push edx
mov eax, dword [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call sub.ntext.dll_memcpy
add esp, 0xc
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x68924a40
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [ebp + 0xc], 0
jne 0x68924a5b
mov eax, 0x57
jmp 0x68924ba0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.68927d30
add esp, 8
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x68924a7e
mov eax, 6
jmp 0x68924ba0
mov edx, dword [ebp + 0x10]
and edx, 0x300
mov dword [ebp + 0x10], edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
or ecx, 0x10000
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.kernelbase.dll_RegOpenKeyExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x68924b1f
call fcn.68927e10
test eax, eax
jne 0x68924b02
mov dword [ebp - 0x10], 0x104
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call sym.kernelbase.dll_RegEnumKeyExA
test eax, eax
jne 0x68924b02
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sym.kernelbase.dll_RegDeleteKeyExA
test eax, eax
je 0x68924b00
jmp 0x68924b02
jmp 0x68924ac0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntext.dll_NtDeleteKey]
push eax
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call fcn.68924510
mov ecx, dword [0x6893c030]
movzx edx, byte [ecx]
and edx, 8
je 0x68924b9d
mov eax, 1
imul eax, eax, 0
movsx ecx, byte [eax + str.D:DevelopOne_CoreOne_Core_Apiwrappers_basekernelbase_wrapper_reg.c]
cmp ecx, 0x2e
jne 0x68924b4a
mov dword [ebp - 0xc], 0x12
jmp 0x68924b51
mov dword [ebp - 0xc], 0x21
push 0x68938310
push 0x42e
push 0x6893c384
mov edx, dword [ebp - 0xc]
add edx, str.D:DevelopOne_CoreOne_Core_Apiwrappers_basekernelbase_wrapper_reg.c
push edx
mov eax, dword [0x6893c030]
push eax
push 3
call fcn.68933a40
add esp, 0x18
cmp eax, 0xffffffff
je 0x68924b9d
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.68918990
add esp, 4
push eax
push str._s_ret_08x_n
call fcn.68933ab0
add esp, 0xc
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x68924bb0
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x68924bc8
mov eax, 0x57
jmp 0x68924cbb
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.68927d30
add esp, 8
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x68924beb
mov eax, 6
jmp 0x68924cbb
mov edx, dword [ebp + 0x10]
and edx, 0x300
mov dword [ebp + 0x10], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
or ecx, 0x10000
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.kernelbase.dll_RegOpenKeyExW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x68924c3a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntext.dll_NtDeleteKey]
push eax
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call fcn.68924510
mov eax, dword [0x6893c030]
movzx ecx, byte [eax]
and ecx, 8
je 0x68924cb8
mov edx, 1
imul edx, edx, 0
movsx eax, byte [edx + str.D:DevelopOne_CoreOne_Core_Apiwrappers_basekernelbase_wrapper_reg.c]
cmp eax, 0x2e
jne 0x68924c64
mov dword [ebp - 0xc], 0x12
jmp 0x68924c6b
mov dword [ebp - 0xc], 0x21
push 0x68938310
push 0x40d
push 0x6893c364
mov ecx, dword [ebp - 0xc]
add ecx, str.D:DevelopOne_CoreOne_Core_Apiwrappers_basekernelbase_wrapper_reg.c
push ecx
mov edx, dword [0x6893c030]
push edx
push 3
call fcn.68933a40
add esp, 0x18
cmp eax, 0xffffffff
je 0x68924cb8
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.689189d0
add esp, 4
push eax
push str._s_ret_08x_n
call fcn.68933ab0
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x68924cd0
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.68927d30
add esp, 8
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x68924d00
mov eax, 6
jmp 0x68924d8a
cmp dword [ebp + 0xc], 0
je 0x68924d2f
lea ecx, [ebp - 4]
push ecx
push 2
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.kernelbase.dll_RegOpenKeyExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x68924d29
mov eax, dword [ebp - 0xc]
jmp 0x68924d8a
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntext.dll_RtlInitAnsiString]
push 1
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.ntext.dll_RtlAnsiStringToUnicodeString]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x68924d71
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntext.dll_NtDeleteValueKey]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.ntext.dll_RtlFreeUnicodeString]
cmp dword [ebp - 4], 0
je 0x68924d80
mov eax, dword [ebp - 4]
push eax
call fcn.68924510
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x68924da0
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.68927d30
add esp, 8
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x68924dcd
mov eax, 6
jmp 0x68924e34
cmp dword [ebp + 0xc], 0
je 0x68924dfc
lea ecx, [ebp - 4]
push ecx
push 2
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.kernelbase.dll_RegOpenKeyExW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x68924df6
mov eax, dword [ebp - 8]
jmp 0x68924e34
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntext.dll_RtlInitUnicodeString]
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntext.dll_NtDeleteValueKey]
push eax
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x68924e31
mov eax, dword [ebp - 4]
push eax
call fcn.68924510
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x68927240
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [0x6893c030]
movzx ecx, byte [eax]
and ecx, 8
je 0x689272ea
mov edx, 1
imul edx, edx, 0
movsx eax, byte [edx + str.D:DevelopOne_CoreOne_Core_Apiwrappers_basekernelbase_wrapper_reg.c]
cmp eax, 0x2e
jne 0x6892727d
mov dword [ebp - 0xc], 0x12
jmp 0x68927284
mov dword [ebp - 0xc], 0x21
push 0x68938310
push 0x25e
push 0x6893c2b8
mov ecx, dword [ebp - 0xc]
add ecx, str.D:DevelopOne_CoreOne_Core_Apiwrappers_basekernelbase_wrapper_reg.c
push ecx
mov edx, dword [0x6893c030]
push edx
push 3
call fcn.68933a40
add esp, 0x18
cmp eax, 0xffffffff
je 0x689272ea
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.68918990
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.68918990
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
push str.__p__s__s__d__p__d__n
call fcn.68933ab0
add esp, 0x1c
cmp dword [ebp + 0xc], 0
je 0x68927334
mov eax, 1
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + eax]
test edx, edx
je 0x68927334
push 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.kernelbase.dll_RegCreateKeyExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6892732e
mov eax, dword [ebp - 8]
jmp 0x68927364
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x68927361
mov eax, dword [ebp - 4]
push eax
call fcn.68924510
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x689274a0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x18], 0
je 0x689274b8
mov eax, dword [ebp + 0x18]
shr eax, 0x10
test eax, eax
je 0x689274c4
cmp dword [ebp + 0x18], 0
jne 0x689274ce
cmp dword [ebp + 0x1c], 0
je 0x689274ce
mov eax, 0x3e6
jmp 0x68927563
cmp dword [ebp + 0x1c], 0
je 0x68927514
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.68927dd0
add esp, 4
test eax, eax
je 0x68927514
mov edx, dword [ebp + 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x1c]
shr eax, 1
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x68927514
mov eax, dword [ebp + 0x1c]
shr eax, 1
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + eax*2]
test edx, edx
jne 0x68927514
mov eax, dword [ebp + 0x1c]
add eax, 2
mov dword [ebp + 0x1c], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.68927d30
add esp, 8
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x68927532
mov eax, 6
jmp 0x68927563
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntext.dll_RtlInitUnicodeString]
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntext.dll_NtSetValueKey]
push eax
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x68928420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
cmp ecx, 0xffff
jne 0x68928446
mov edx, dword [ebp + 0xc]
neg edx
mov dword [ebp + 0xc], edx
push 6
mov eax, dword [ebp + 0xc]
shr eax, 4
and eax, 0xffff
movzx ecx, ax
add ecx, 1
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp + 8]
push eax
call sym.kernelbase.dll_FindResourceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x6892847c
xor eax, eax
jmp 0x68928536
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.kernelbase.dll_LoadResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x68928499
xor eax, eax
jmp 0x68928536
mov eax, dword [ebp - 0x10]
push eax
call sym.kernelbase.dll_LockResource
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xf
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x18], 0
je 0x689284d5
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*2 + 2]
mov dword [ebp - 4], ecx
jmp 0x689284ae
cmp dword [ebp + 0x10], 0
jne 0x689284e3
mov edx, dword [ebp - 4]
movzx eax, word [edx]
jmp 0x68928536
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, dword [ebp + 0x14]
jge 0x689284f9
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov dword [ebp - 0x14], eax
jmp 0x68928502
mov ecx, dword [ebp + 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp + 0x14], edx
cmp dword [ebp + 0x14], 0
jl 0x68928533
mov eax, dword [ebp + 0x14]
shl eax, 1
push eax
mov ecx, dword [ebp - 4]
add ecx, 2
push ecx
mov edx, dword [ebp + 0x10]
push edx
call sub.ntext.dll_memcpy
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov word [edx + ecx*2], ax
mov eax, dword [ebp + 0x14]
mov esp, ebp
pop ebp
ret