joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb9225c
Capabilities:
Get session user name

Disassembly:
push 0x43c
mov eax, 0xbc8d13
call fcn.00bc132b
call fcn.00b9288e
test eax, eax
je 0xb922ce
push 0x100
lea eax, [ebp - 0x210]
mov ebx, 0xb27250
push eax
push 2
push 0xb278d0
mov edx, ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bbc0f1
xor edi, edi
test eax, eax
jns 0xbd667c
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], edi
push eax
push ecx
push 0xb278a4
mov edx, ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00b819c7
cmp dword [ebp - 0x444], 0
jne 0xbd677a
xor eax, eax
call fcn.00bc12da
ret
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], 0x111
push eax
lea eax, [ebp - 0x438]
push eax
push 2
call dword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
je 0xb922a2
push 0x5c
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrChrW]
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x210]
add eax, 2
push ecx
push 0xffffffffffffffff
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
je 0xb922a2
mov dword [ebp - 0x43c], edi
lea ecx, [ebp - 0x43c]
mov dword [ebp - 4], edi
call fcn.00b8ba6f
lea eax, [ebp - 0x43c]
mov edx, 0xb47710
push eax
mov ecx, 0xb47720
call fcn.00cc1e7c
mov esi, eax
test esi, esi
jns 0xbd670a
mov edx, 0x6dd
jmp 0xbd672b
mov eax, dword [ebp - 0x43c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, eax
test esi, esi
jns 0xbd6766
mov edx, 0x6de
mov ecx, dword [ebp + 4]
push esi
push 0xb27854
call fcn.00bc2921
lea ecx, [ebp - 0x43c]
jmp 0xbd675a
mov edx, 0x6ea
mov ecx, dword [ebp + 4]
push esi
push 0xb27854
call fcn.00bc2921
lea ecx, [ebp - 0x440]
call fcn.00b8ba6f
mov eax, esi
jmp 0xb922d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.00b8ba6f
jmp 0xb922a2
call fcn.00bc267f
test al, al
je 0xb922ce
mov dword [ebp - 0x440], edi
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 1
call fcn.00b8ba6f
lea eax, [ebp - 0x440]
mov edx, 0xb47710
push eax
mov ecx, 0xb47720
call fcn.00cc1e7c
mov esi, eax
test esi, esi
jns 0xbd67c2
mov edx, 0x6e9
jmp 0xbd6746
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, eax
test esi, esi
js 0xbd6741
lea ecx, [ebp - 0x440]
call fcn.00b8ba6f
jmp 0xb922ce
Function at 0xb92a57
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push esi
push eax
push 0x20019
xor ebx, ebx
mov esi, ecx
push ebx
push 0xb27670
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xb92be0
push edi
push 4
pop edi
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xb2764c
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xb92ac4
cmp dword [ebp - 8], edi
jne 0xb92ac4
cmp dword [ebp - 4], edi
jne 0xb92ac4
mov eax, dword [ebp - 0xc]
cmp eax, 0x3e8
jb 0xb92ac4
mov dword [esi + 0x18], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xb27628
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xb92afb
cmp dword [ebp - 8], edi
jne 0xb92afb
cmp dword [ebp - 4], edi
jne 0xb92afb
mov eax, dword [ebp - 0xc]
cmp eax, 0x64
jb 0xb92afb
mov dword [esi + 0xc], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xb27610
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xb92b32
cmp dword [ebp - 8], edi
jne 0xb92b32
cmp dword [ebp - 4], edi
jne 0xb92b32
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0xc]
jbe 0xb92b32
mov dword [esi + 0x10], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xb275e4
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xb92b69
cmp dword [ebp - 8], edi
jne 0xb92b69
cmp dword [ebp - 4], edi
jne 0xb92b69
mov eax, dword [ebp - 0xc]
cmp eax, 0x32
jae 0xb92b69
mov dword [esi + 8], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xb275bc
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xb92b9f
cmp dword [ebp - 8], edi
jne 0xb92b9f
cmp dword [ebp - 4], edi
jne 0xb92b9f
mov eax, dword [ebp - 0xc]
test eax, eax
je 0xb92b9f
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xb275a0
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xb92bd6
cmp dword [ebp - 8], edi
jne 0xb92bd6
cmp dword [ebp - 4], edi
jne 0xb92bd6
mov eax, dword [ebp - 0xc]
cmp eax, 0x32
jbe 0xb92bd6
mov dword [esi + 0x30], eax
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb92bf9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0xd08954]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x18], edx
push edi
mov ebx, eax
lea eax, [esp + 0x20]
push 0x104
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
je 0xb92c7c
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
mov ecx, eax
mov dword [esp + 0xc], ecx
test ecx, ecx
jne 0xb92c7c
xor edx, edx
mov edi, esi
cmp word [esi], dx
jne 0xbd6b0d
cmp word [edi], dx
jne 0xb92c95
xor ecx, ecx
inc ecx
mov dword [esp + 0xc], ecx
cmp word [esi], dx
jne 0xbd6b2f
lea esi, [edi + 2]
test ecx, ecx
je 0xb92c55
mov ecx, dword [esp + 0x22c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov word [edi], ax
jmp 0xb92c6c
movzx eax, word [edi]
cmp eax, 0x20
je 0xb92c60
cmp eax, 0x2c
je 0xb92c60
add edi, 2
cmp word [edi], dx
jne 0xbd6b0d
jmp 0xb92c60
test dword [0xd0a5c0], 0x4000
je 0xbd6b4d
mov ecx, esi
call fcn.00b8dfec
push eax
mov edx, 0xb26b10
call fcn.00b90dd1
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push ebx
push ecx
push ecx
push dword [esp + 0x2c]
lea eax, [esp + 0x34]
xor edx, edx
push eax
mov ecx, esi
call fcn.00b8e653
test eax, eax
jns 0xbd6bcb
push 0xb49c90
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
test dword [0xd0a5c0], 0x4000
mov ebx, eax
je 0xbd6b9c
mov ecx, esi
call fcn.00b8dfec
push eax
push 0
mov edx, 0xb26b00
call fcn.00b80c4c
test ebx, ebx
je 0xbd6bbc
push esi
push 0x1030
push 0x20c
push 0x203
push 0
push ebx
call dword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_ShellMessageBoxW]
add esp, 0x18
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
xor edx, edx
jmp 0xb92c75
mov edx, dword [esp + 0x10]
mov ecx, ebx
call fcn.00b8e006
test dword [0xd0a5c0], 0x4000
je 0xbd6bff
mov ecx, esi
call fcn.00b8dfec
push eax
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
push eax
mov edx, 0xb26b00
call fcn.00b80c4c
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ebx, ebx
inc ebx
mov dword [esp + 0x14], ebx
jmp 0xbd6bc0
Function at 0xb9a560
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
mov esi, 0xb32860
xor ebx, ebx
push ebx
push 0xb27ee8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x18], 2
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
test eax, eax
je 0xb9a5d2
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0x4a
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
and al, 1
mov bl, al
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret

Function at 0xb9ae37
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0xb27ee8
mov edi, edx
mov ebx, ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
mov esi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0xb9ae7e
js 0xb9ae63
mov eax, 0x80004005
test esi, esi
je 0xbda4c9
push dword [ebp + 8]
push edi
push ebx
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_PostMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 4
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xb9ae5c
mov ecx, dword [ebp + 4]
mov edx, 0x380
push eax
push 0xb27854
call fcn.00b913f8
jmp 0xb9ae77
Function at 0xb9afb5
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
xor edi, edi
cmp dword [ebx + 0xa8], edi
ja 0xb9b149
lea eax, [ebp - 0x41c]
push eax
push 9
push edi
push 0xb27de8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jg 0xbda4e1
js 0xb9b136
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x428]
push eax
push edi
push edi
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jg 0xbda4f1
js 0xb9b12a
cmp dword [ebp - 0x428], edi
jbe 0xb9b12a
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x104
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHEnumKeyExW]
mov esi, eax
test esi, esi
jg 0xbda501
js 0xb9b11d
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x104
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x434]
push eax
push 2
push 0xb27f04
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jg 0xbda511
js 0xb9b11d
and dword [ebp - 0x424], 0
lea eax, [ebp - 0x424]
and dword [ebp - 0x420], 0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_SHStrDupW]
test eax, eax
js 0xbda521
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_SHStrDupW]
test eax, eax
js 0xbda521
push ecx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebx + 0xa4]
call fcn.00bbc596
mov esi, eax
test esi, esi
js 0xbda521
inc edi
cmp edi, dword [ebp - 0x428]
jb 0xb9b040
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0xb9b138
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xb9b001
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xb9b02e
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xb9b06f
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xb9b0b8
push dword [ebp - 0x424]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
push dword [ebp - 0x420]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xb9b11d
Function at 0xb9b764
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov bl, byte [ebp + 8]
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
stosd dword es:[edi], eax
mov esi, 0xb32850
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
test bl, bl
lea edi, [ebp - 0x14]
setne al
mov dword [ebp - 0x18], eax
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x28]
xor esi, esi
stosd dword es:[edi], eax
push esi
push 0xb27ee8
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x24], 0x14
mov dword [ebp - 0x20], eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowExW]
test eax, eax
je 0xb9b7dd
lea ecx, [ebp - 0x28]
push ecx
push esi
push 0x4a
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
test bl, bl
jne 0xbda742
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x1c]
call fcn.00b9b14d
jmp 0xb9b7e5
Function at 0xb9d9c9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1224
call fcn.00bc6320
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x1211]
push ebx
push esi
push edi
push edx
xor ebx, ebx
mov dword [ebp - 0x1220], ecx
mov edx, eax
mov dword [ebp - 0x1224], eax
mov byte [ebp - 0x1211], bl
call fcn.00b9da8b
mov esi, eax
test esi, esi
js 0xbdb43c
cmp byte [ebp - 0x1211], bl
jne 0xb9da76
lea eax, [ebp - 0x121c]
mov dword [ebp - 0x1218], ebx
push eax
lea eax, [ebp - 0x1218]
mov dword [ebp - 0x121c], 4
push eax
push ebx
push 0x10
push 0xb28090
mov esi, 0xb28018
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, 0xb3fc3c
test eax, eax
je 0xbdb478
mov esi, ebx
test esi, esi
js 0xbdb462
mov ecx, dword [ebp - 0x1224]
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8
push esi
push 0xb3fc3c
mov edx, 0x12b
jmp 0xbdb469
mov ecx, dword [ebp + 4]
mov esi, 0x80070057
push esi
mov edi, 0xb3fc3c
mov edx, 0x11d
push edi
call fcn.00bc28ed
push esi
push edi
mov edx, 0x133
mov ecx, dword [ebp + 4]
call fcn.00bc2921
mov eax, esi
jmp 0xb9da78
push dword [ebp - 0x1220]
lea eax, [ebp - 0x1210]
push dword [ebp - 0x1218]
push esi
push 0xb3fc28
push 0x800
push eax
call fcn.00b55e8f
mov esi, eax
add esp, 0x18
test esi, esi
jns 0xbdb4bf
mov edx, 0xf7
jmp 0xbdb4b0
mov edx, 0x116
mov ecx, dword [ebp + 4]
push esi
push edi
call fcn.00bc2921
jmp 0xb9da62
mov esi, dword [ebp - 0x1224]
cmp dword [esi], ebx
jl 0xbdb449
cmp dword [esi], 1
jle 0xbdb55b
cmp dword [esi], 2
jne 0xbdb449
push 0x208
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x1220], 0x208
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push 2
push 0xb3fc1c
lea eax, [ebp - 0x1210]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xbdb5a2
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xbdb52f
sub ecx, edx
lea eax, [esi + 8]
push eax
sar ecx, 1
lea eax, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateString]
mov esi, eax
test esi, esi
jns 0xbdb5a0
jmp 0xbdb4ab
lea eax, [ebp - 0x121c]
mov dword [ebp - 0x1218], ebx
push eax
lea eax, [ebp - 0x1218]
mov dword [ebp - 0x121c], 4
push eax
push ebx
push 0x10
push 0xb3fc1c
lea eax, [ebp - 0x1210]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xbdb5a2
mov eax, dword [ebp - 0x1218]
mov dword [esi + 4], eax
mov bl, 1
test bl, bl
je 0xb9da6a
jmp 0xb9da76
Function at 0xb9da8b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
xor ecx, ecx
mov byte [edi], cl
cmp dword [esi], ecx
jl 0xbdb607
cmp dword [esi], 1
jg 0xb9db0a
lea eax, [ebp - 0x220]
mov dword [ebp - 0x218], ecx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 4
push eax
push ecx
push 0x10
push ebx
push 0xb280a0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0xbdb5f6
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
cmp dword [esi], 2
jne 0xbdb607
push 0x208
push ecx
lea eax, [ebp - 0x214]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
xor eax, eax
push eax
push 2
push ebx
push 0xb280a0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb9daf5
jmp 0xbdb5af
lea ecx, [ebp - 0x214]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xbdb5ba
sub ecx, edx
lea eax, [esi + 8]
push eax
sar ecx, 1
lea eax, [ebp - 0x214]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateString]
mov esi, eax
test esi, esi
jns 0xbdb5ff
mov ecx, dword [ebp + 4]
mov edx, 0xdd
push esi
push 0xb3fc3c
call fcn.00bc2921
jmp 0xbdb61f
mov eax, dword [ebp - 0x218]
mov dword [esi + 4], eax
mov byte [edi], 1
jmp 0xb9daf5
mov ecx, dword [ebp + 4]
mov esi, 0x80070057
push esi
push 0xb3fc3c
mov edx, 0xe4
call fcn.00bc28ed
mov eax, esi
jmp 0xb9daf7
Function at 0xba0d28
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0xbc988d
call fcn.00bc132b
mov eax, ecx
mov dword [ebp - 0x2c], eax
xor bl, bl
cmp dword [eax + 0x10], 0
je 0xbdc03f
push 1
push 0xb2a5a8
push 0xb2a0c0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_stream_l1_1_0.dll_SHOpenRegStream2W]
mov esi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], esi
call fcn.00b960c7
and dword [ebp - 4], 0
test esi, esi
je 0xba0dc7
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x24], 0x14
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0x10001
push dword [edi + 0x10]
call fcn.00b7eb2d
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
test eax, eax
je 0xba0dc7
push 0x14
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.api_ms_win_shcore_stream_l1_1_0.dll_IStream_Write]
test eax, eax
js 0xba0dc7
push esi
push dword [edi + 0x10]
call fcn.00bbf808
test eax, eax
setne bl
lea ecx, [ebp - 0x28]
call fcn.00b8ba6f
test bl, bl
je 0xbdc03f
mov al, bl
call fcn.00bc12da
ret
lea eax, [ebp - 0x28]
push eax
push 0x20006
push 0
push 0xb2a0c0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xba0dd7
push 0xb2a5a8
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xba0dd7
Function at 0xba44cd
Capabilities:
Hide graphical window

Disassembly:
cmp byte [0xd0a416], 0
push esi
mov esi, ecx
jne 0xba44f5
push 5
push dword [esi + 0x2c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ShowWindow]
push 0
mov ecx, esi
call fcn.00ba449b
mov ecx, esi
pop esi
jmp fcn.00ba435d
push 0
jmp 0xba44db
Function at 0xba8379
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x418]
push eax
push ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowThreadProcessId]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x418]
cmp ecx, eax
jne 0xbf4c16
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
push edi
xor bl, bl
mov dword [ebp - 0x420], 0xb43480
xor edi, edi
push esi
test bl, bl
jne 0xbf4cee
push ecx
push 0
push 0x1000
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0xbf4ccb
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push esi
call dword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_QueryFullProcessImageNameW]
test eax, eax
je 0xbf4c6f
xor eax, eax
jmp 0xbf4c8a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xbf4c83
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xbf4c8a
mov eax, 0x80004005
test eax, eax
js 0xbf4ccb
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + edi*4 - 0x420]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0xbf4ccb
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
sete bl
mov ecx, esi
call fcn.00bbddef
test al, al
jne 0xbf4cdd
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
inc edi
cmp edi, 1
jae 0xbf4cee
mov ecx, dword [ebp - 0x418]
jmp 0xbf4c26
pop esi
pop edi
jmp 0xba83b3

Function at 0xba8f45
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xd0a644]
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
xor esi, esi
test edi, edi
je 0xba8f77
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 2
push esi
push esi
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0xba8fa8
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0xba8f91
xor esi, esi
inc esi
test edi, edi
je 0xba8f9e
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
jmp 0xba8fa0