joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8dcd10
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb14060
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x230], eax
mov ebx, edx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x22c], 0
test edi, edi
je 0x8dcd73
mov dword [edi], 0
cmp ebx, 0xffffffff
je 0x8dce62
test esi, esi
jne 0x8dcd8a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x8dce62
test esi, esi
jbe 0x8dce62
mov ecx, dword [0xb3dddc]
shl ecx, 0x14
cmp esi, ecx
ja 0x8dce62
push 0
push esi
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [edi], eax
test eax, eax
je 0x8dce62
push esi
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x8dce62
mov dword [ebp - 4], 0
jmp 0x8dce5b
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8dd160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb10af0
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], edi
cmp dword [ebp + 8], edi
je 0x8dd284
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x8dd1b5
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x1c], eax
push str.gmer.pdb
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
cmp dword [ebp + 0x10], ebx
jl 0x8dd284
mov dword [ebp - 0x20], edi
mov eax, dword [ebp + 0x10]
sub eax, ebx
cmp edi, eax
jg 0x8dd284
mov ecx, dword [ebp + 8]
lea esi, [edi + ecx]
mov al, byte [esi]
cmp al, 0x61
jb 0x8dd1f3
cmp al, 0x7a
ja 0x8dd1f3
movzx eax, al
sub eax, 0x20
jmp 0x8dd1f6
movzx eax, al
mov cl, 0x47
movsx edx, cl
cmp edx, eax
jne 0x8dd266
mov al, byte [esi + 1]
cmp al, 0x61
jb 0x8dd212
cmp al, 0x7a
ja 0x8dd212
movzx eax, al
sub eax, 0x20
jmp 0x8dd215
movzx eax, al
mov cl, 0x4d
movsx ecx, cl
cmp ecx, eax
jne 0x8dd266
push ebx
mov eax, esi
mov ecx, str.gmer.pdb
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8dd24b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x8dd266
mov edx, dword [ebp - 0x1c]
push edx
mov eax, esi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8dd266
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc edi
jmp 0x8dd1cb
mov dword [ebp - 4], 0xfffffffe
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8dd2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
mov dword [ebp - 0x134], eax
xor eax, eax
push eax
push eax
push esi
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call edi
push 0
push 0
push 0x8000
push esi
mov ebx, eax
call edi
push 0
lea edx, [ebp - 0x13c]
push edx
push 0x20
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push esi
mov dword [ebp - 0x138], eax
call edi
cmp dword [ebp - 0x138], 0
je 0x8dd457
mov eax, dword [ebp - 0x24]
cmp al, 1
jne 0x8dd395
cmp ah, 0x43
jne 0x8dd418
cmp byte [ebp - 0x22], 0x44
jne 0x8dd418
cmp byte [ebp - 0x1e], al
jne 0x8dd418
mov ecx, dword [ebp - 0x134]
mov dword [ecx], 1
cmp dword [0xbc27fc], 0
je 0x8dd423
push 0x103
lea edx, [ebp - 0x12f]
push 0
push edx
mov byte [ebp - 0x130], 0
call fcn.00a7ffb0
movsx eax, byte [ebp + 0xc]
add esp, 0xc
push eax
push str.ForceScanArj_set___c_
jmp 0x8dd3e5
test al, al
jne 0x8dd418
cmp ah, 0x42
jne 0x8dd418
cmp byte [ebp - 0x22], 0x45
jne 0x8dd418
cmp byte [ebp - 0x1e], 1
jne 0x8dd418
mov ecx, dword [ebp - 0x134]
mov dword [ecx], 1
cmp dword [0xbc27fc], 0
je 0x8dd423
push 0x103
lea edx, [ebp - 0x12f]
push 0
push edx
mov byte [ebp - 0x130], al
call fcn.00a7ffb0
movsx eax, byte [ebp + 0xc]
add esp, 0xc
push eax
push str.ForceScanArj_set___c1_
push 0xffffffffffffffff
lea ecx, [ebp - 0x130]
push 0x104
push ecx
call fcn.00a78fcb
mov edx, dword [0xbc27fc]
add esp, 0x14
push 0
push edx
lea eax, [ebp - 0x130]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [ebp - 0x134]
cmp dword [ecx], 0
je 0x8dd457
mov eax, str.Win32
lea ecx, [ebp - 0x1c]
call fcn.0094c3e0
test eax, eax
je 0x8dd44b
push 5
lea edx, [ebp - 0x23]
push str.BEA01
push edx
call fcn.00a7aed7
add esp, 0xc
test eax, eax
jne 0x8dd457
mov eax, dword [ebp - 0x140]
mov dword [eax], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8ed450
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb10ad0
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push 0x80
push 3
push 1
push 0x80000000
mov edi, ecx
call fcn.0094db00
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
je 0x8ed4d1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x8ed4e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00985290
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push edi
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x8ed525
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00985290
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x8ed56d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea edx, [ebp - 0x1c]
push edx
call fcn.00985290
lea eax, [ebp - 0x28]
push eax
call fcn.00985290
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], ebx
lea ebx, [edi + 1]
push ebx
call fcn.00a7a155
add esp, 4
mov esi, eax
test esi, esi
je 0x8ed5fd
push ebx
push 0
push esi
call fcn.00a7ffb0
add esp, 0xc
push edi
mov ecx, dword [ebp - 0x24]
push ecx
push esi
call fcn.00a828e0
add esp, 0xc
push 0
push 0xaa1ab8
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ed5db
push 0
push 0xaa154c
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ed5db
push 0
push str.Seagate
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8ed5e2
mov dword [ebp - 0x20], 1
push esi
call fcn.00a78fec
add esp, 4
jmp 0x8ed5fd
mov dword [ebp - 4], 0xfffffffe
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [ebp - 0x28]
push eax
call fcn.00985290
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00985290
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8edbc0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ecx
push ebx
push esi
push 0xb524c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0xbf4a9c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x8edbec
call esi
sub eax, dword [0xbf4a9c]
cmp eax, 0x2710
jbe 0x8edc28
cmp dword [0xbd0650], 0
jne 0x8edc28
call esi
push 0
push 0
push 0x8edb60
mov dword [0xbf4a9c], eax
mov dword [0xbd0650], 1
call fcn.00a791b2
add esp, 0xc
push str.CBD_7m
xor ebx, ebx
mov esi, eax
call fcn.0085df20
add esp, 4
push 0xb524c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
pop ecx
ret
Function at 0x8f7350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
push 0x103
xor esi, esi
lea eax, [esp + 0x1d]
push esi
push eax
mov byte [esp + 0x24], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push esi
push 0xaa21e4
push 0x80000002
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8f73f0
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push esi
push esi
push str.DebugZ
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x8f73e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0x14]
cmp ebx, esi
jne 0x8f7431
push esi
push 2
push esi
push 0x2000501
call dword [0xb8dac4]
push esi
push 2
push esi
push 0x2000601
call dword [0xb8dac4]
push esi
push 1
push esi
push 0x2000804
call dword [0xb8dac4]
push esi
push 1
push esi
push 0x200070b
call dword [0xb8dac4]
add esp, 0x40
jmp 0x8f7492
test bl, 1
je 0x8f7448
push esi
push 2
push esi
push 0x2000501
call dword [0xb8dac4]
add esp, 0x10
test bl, 2
je 0x8f745f
push esi
push 2
push esi
push 0x2000601
call dword [0xb8dac4]
add esp, 0x10
test bl, 4
je 0x8f7476
push esi
push 1
push esi
push 0x2000804
call dword [0xb8dac4]
add esp, 0x10
test bl, 8
je 0x8f748d
push esi
push 1
push esi
push 0x200070b
call dword [0xb8dac4]
add esp, 0x10
test bl, 0x10
je 0x8f749b
push esi
call fcn.008f8740
add esp, 4
lea ebx, [esp + 0x18]
call fcn.009b7b40
call fcn.009b7cf0
call fcn.009b7ea0
call fcn.009b80c0
call fcn.009b8050
mov ecx, dword [esp + 0x124]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
mov dword [0xbd17a4], eax
mov dword [0xbd0e64], eax
mov dword [0xbd17ac], eax
mov dword [0xbd148c], eax
mov dword [0xbd1594], eax
mov dword [0xbd169c], eax
mov dword [0xbd127c], eax
mov dword [0xbd1384], eax
mov dword [0xbd1174], eax
mov dword [0xbd17a8], eax
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8f7870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb15220
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x524
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x534], ebx
mov byte [ebp - 0x530], bl
push ebx
call fcn.008f8740
add esp, 4
lea eax, [ebp - 0x534]
push eax
push str.RegMonitor
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [0xb56804], ebx
je 0x8f78f7
mov dword [ebp - 0x534], ebx
mov dword [0xb8db08], ebx
jmp 0x8f79f6
cmp dword [ebp - 0x534], ebx
je 0x8f78ec
push ebx
push ebx
push 0x898580
call fcn.00a791b2
mov esi, eax
push str.CBD_7q
xor ebx, ebx
call fcn.0085df20
add esp, 0x10
cmp esi, 0xffffffff
jne 0x8f7971
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea ecx, [ebp - 0x11f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_a6__fails_with_error__d
push esi
push 0x104
lea edx, [ebp - 0x120]
push edx
call fcn.00a78fcb
push ebx
push 1
lea eax, [ebp - 0x120]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x24
xor ebx, ebx
cmp dword [ebp - 0x534], ebx
je 0x8f78ec
call fcn.00898340
test eax, eax
jne 0x8f78ec
push ebx
cmp dword [ebp - 0x534], 2
jne 0x8f799a
push 1
jmp 0x8f799b
push ebx
push ebx
push 0x2000204
call dword [0xb8dac4]
add esp, 0x10
push ebx
push 1
push str.Registry_Monitoring_Has_Been_Enabled.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [0xb8db08], 1
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x8f79ff
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8f7b60
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
push 0x103
mov edi, ecx
lea ecx, [ebp - 0x31f]
push ebx
push ecx
mov dword [ebp - 0x328], eax
mov byte [ebp - 0x320], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x217]
push ebx
push edx
mov byte [ebp - 0x218], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x32c], ebx
call fcn.00968110
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
cmp esi, ebx
je 0x8f7bf8
mov byte [esi], bl
mov ecx, dword [ebp - 0x328]
cmp ecx, ebx
je 0x8f7c04
mov byte [ecx], bl
lea ecx, [ebp - 0x324]
push ecx
push eax
push edi
push 0x80000003
call fcn.0097eda0
test eax, eax
jne 0x8f7c82
mov ecx, dword [ebp - 0x324]
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push str.ProxyServer
push ecx
mov byte [ebp - 0x110], bl
mov dword [ebp - 0x330], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x8f7c82
cmp byte [ebp - 0x110], bl
jne 0x8f7c65
mov dword [ebp - 0x32c], 1
jmp 0x8f7c82
lea edx, [ebp - 0x218]
push edx
lea ebx, [ebp - 0x320]
lea ecx, [ebp - 0x110]
call fcn.008f7a20
add esp, 4
xor ebx, ebx
mov eax, dword [ebp - 0x324]
cmp eax, ebx
je 0x8f7c99
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], ebx
cmp dword [ebp - 0x32c], ebx
je 0x8f7cf0
call fcn.00968110
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x324]
push ecx
add eax, 0xf003f
push eax
push edi
push 0x80000003
call fcn.0097eda0
test eax, eax
jne 0x8f7cf0
mov edx, dword [ebp - 0x324]
push str.ProxyServer
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], ebx
cmp byte [ebp - 0x320], bl
je 0x8f7d3d
cmp byte [ebp - 0x218], bl
je 0x8f7d3d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, ebx
je 0x8f7d14
lea ecx, [ebp - 0x320]
push ecx
push esi
call edi
mov eax, dword [ebp - 0x328]
cmp eax, ebx
je 0x8f7d28
lea edx, [ebp - 0x218]
push edx
push eax
call edi
mov eax, 1
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8f7d50
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x408], ebx
mov dword [ebp - 0x40c], ebx
call fcn.00968110
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
mov byte [ebp - 0x404], bl
cmp edi, ebx
je 0x8f7d9a
mov byte [edi], bl
lea ecx, [ebp - 0x408]
push ecx
push eax
push esi
push 0x80000003
call fcn.0097eda0
test eax, eax
jne 0x8f7df3
mov ecx, dword [ebp - 0x408]
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push str.AutoConfigURL
push ecx
mov dword [ebp - 0x410], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x8f7df3
cmp byte [ebp - 0x404], bl
jne 0x8f7df3
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x408]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x8f7e0c
push eax
call edi
mov dword [ebp - 0x408], ebx
cmp dword [ebp - 0x40c], ebx
je 0x8f7e5f
call fcn.00968110
neg eax
sbb eax, eax
and eax, 0x100
lea edx, [ebp - 0x408]
push edx
add eax, 0xf003f
push eax
push esi
push 0x80000003
call fcn.0097eda0
test eax, eax
jne 0x8f7e5f
mov eax, dword [ebp - 0x408]
push str.AutoConfigURL
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x408]
push ecx
call edi
mov dword [ebp - 0x408], ebx
cmp byte [ebp - 0x404], bl
je 0x8f7e94
mov eax, dword [ebp - 0x414]
cmp eax, ebx
je 0x8f7e7f
lea edx, [ebp - 0x404]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8f81d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x110], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x317]
push ebx
push ecx
mov byte [ebp - 0x318], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x40f
lea edx, [ebp - 0xc3f]
push ebx
push edx
mov byte [ebp - 0xc40], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x40f
lea eax, [ebp - 0x82f]
push ebx
push eax
mov byte [ebp - 0x830], bl
call fcn.00a7ffb0
add esp, 0xc
push str.REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea ecx, [ebp - 0x830]
push ecx
lea edi, [ebx + 1]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea edx, [ebp - 0x318]
push str.REGISTRYUSER_s
push edx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x830]
push str.REGISTRYUSERCSID
push ecx
call fcn.0095e130
lea edx, [ebp - 0xc40]
add esp, 0xc
push edx
xor edx, edx
lea ecx, [ebp - 0x830]
call fcn.008ff7e0
add esp, 4
lea ecx, [ebp - 0x110]
lea esi, [ebp - 0xc40]
call fcn.008f7d50
cmp byte [ebp - 0x110], bl
je 0x8f835d
lea ecx, [ebp - 0x110]
call fcn.009245b0
mov esi, eax
cmp esi, ebx
jne 0x8f834a
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x420]
push str.Clearing_IE_AutoConfigURL_Settings._Old_Value_____s
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
push edi
lea edx, [ebp - 0x420]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push str.AutoConfigURL
lea ecx, [ebp - 0xc40]
mov edx, 0x80000003
call fcn.0094c180
cmp al, 1
je 0x8f834a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x8f834a
push str.AutoConfigURL
call fcn.00989f40
cmp eax, edi
jne 0x8f834a
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8fba30
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push 0x207
lea ecx, [ebp - 0x20f]
push ebx
push ecx
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x41c], ebx
xor esi, esi
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x417]
push ebx
push edx
call fcn.00a7ffb0
add esp, 0xc
mov eax, 0x208
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x418]
push ecx
push ebx
push ebx
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
mov byte [ebp - 0x418], bl
mov byte [ebp - 0x210], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x8fbba7
lea ecx, [ecx]
cmp byte [ebp - 0x418], bl
je 0x8fbb45
mov eax, dword [ebp - 0x428]
cmp eax, ebx
je 0x8fbb19
cmp byte [eax], bl
je 0x8fbb19
push ebx
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fbb45
mov eax, 1
mov dword [ebp - 0x41c], eax
cmp dword [ebp + 0xc], ebx
je 0x8fbba9
lea edx, [ebp - 0x210]
push edx
jmp 0x8fbb39
cmp dword [ebp + 0xc], ebx
je 0x8fbb45
mov eax, str.2719
lea ecx, [ebp - 0x210]
call fcn.0094c3e0
test eax, eax
jne 0x8fbb45
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x8fbb45
dec esi
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x418]
push edx
push ebx
mov eax, 0x208
push ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x210]
push ecx
inc esi
push esi
push edi
mov byte [ebp - 0x418], bl
mov byte [ebp - 0x210], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x8fbad0
mov eax, dword [ebp - 0x41c]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
Function at 0x8fbbc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push str.ChromeBLAdded
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [ebp - 8], 0
call fcn.0094c0d0
cmp dword [ebp - 8], 0
je 0x8fbcd2
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push str.SOFTWAREPoliciesGoogleChromeExtensionInstallBlacklist
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call ebx
test esi, esi
jne 0x8fbc34
mov edi, dword [ebp - 4]
push 1
push esi
call fcn.008fba30
mov edx, dword [ebp - 4]
add esp, 8
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00968110
test eax, eax
je 0x8fbc9c
call fcn.00968110
test eax, eax
jne 0x8fbc63
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREPoliciesGoogleChromeExtensionInstallBlacklist
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x8fbc7b
lea ecx, [ebp - 4]
push ecx
push 0xf013f
push str.SOFTWAREPoliciesGoogleChromeExtensionInstallBlacklist
push 0x80000002
call fcn.0097eda0
mov esi, eax
push esi
call ebx
test esi, esi
jne 0x8fbc9c
mov edi, dword [ebp - 4]
push 1
push esi
call fcn.008fba30
mov edx, dword [ebp - 4]
add esp, 8
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.ChromeBLAdded
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
cmp al, 1
je 0x8fbcd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x8fbcd2
push str.ChromeBLAdded
call fcn.00989f40
cmp eax, 1
jne 0x8fbcd2
push 0
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret