joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa5c268
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x50
mov eax, 0xafcf12
call fcn.00af8df7
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0xd]
call fcn.00a5c54a
test eax, eax
js 0xa5c290
cmp byte [ebp - 0xd], 0
jne 0xb23c45
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x18]
push ecx
mov dword [ebp - 0x2c], eax
mov ecx, 0xc97a88
mov eax, dword [ebp + 4]
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], eax
mov eax, 0x86
push 0
push 1
mov dword [ebp - 0x40], 0x9f0258
mov word [ebp - 0x38], ax
call fcn.00a40837
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x28]
call fcn.00a5c248
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x9d2e1c
call fcn.00a485a1
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], 0x79780d
lea edx, [ebp - 0x5c]
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x28]
call fcn.00a5c31b
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0xa5c30f
mov eax, dword [ebp - 0x50]
mov dword [ecx + 0xc], eax
or dword [ebp - 4], 0xffffffff
call fcn.00af8dc0
ret 4
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 4
push eax
xor ebx, ebx
push ebx
push 0x10
push edi
push 0x9f03f0
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jle 0xb23c7e
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xb23ca9
test edi, edi
jne 0xb23c89
mov edi, 0x9f0a04
push edi
push 0x9f03f0
push 0xa2083c
push esi
push 0xa207e8
push 0x4f
push dword [ebp + 4]
call fcn.00b86ae3
add esp, 0x1c
jmp 0xb23cae
mov ebx, dword [ebp - 0x20]
xor esi, esi
test esi, esi
js 0xa5c290
mov eax, dword [ebp - 0x18]
test eax, ebx
je 0xa5c290
cmp eax, 1
jne 0xb23cd3
lea ecx, [ebp - 0x14]
call fcn.00bf3f3c
jmp 0xa5c290
cmp eax, 2
jne 0xa5c290
lea ecx, [ebp - 0x14]
call fcn.00bf3f0d
jmp 0xa5c290

Function at 0xa5cc9a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea ecx, [ebp - 8]
push esi
push edi
call fcn.00a5c05b
xor esi, esi
inc esi
test eax, eax
js 0xa5ccbc
cmp dword [ebp - 8], esi
je 0xa5cd49
push ecx
push ecx
push esi
mov ecx, 0xc974f8
call fcn.00a458c8
lea eax, [ebp - 4]
mov dword [ebp - 8], 2
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push 0
push 0x10
push 0x9f0378
push 0x9f0528
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, 0x80070000
test eax, eax
jle 0xa5cd06
movzx eax, ax
or eax, edi
cmp eax, 0x80070002
jne 0xa5cd46
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0
push 0x10
push 0x9f03a4
push 0x9f0528
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jle 0xa5cd44
movzx eax, ax
or eax, edi
test eax, eax
jns 0xa5cd4f
mov esi, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
leave
ret
cmp dword [ebp - 4], 0
ja 0xa5cd49
jmp 0xa5cd46
Function at 0xa5e670
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], 0xc
push eax
mov dword [ebp - 0x14], eax
mov esi, edx
mov dword [ebp - 0x10], eax
mov edi, ecx
lea eax, [ebp - 0x18]
push eax
push 0xc
push 0x42
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
test eax, eax
je 0xa5e6ad
mov eax, dword [ebp - 0x14]
and eax, 1
jne 0xb24afa
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push 0x10
push 0x9f04dc
push 0x9f0660
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jg 0xb24b17
js 0xa5e6f0
cmp dword [ebp - 4], 0
jne 0xb24b26
sub esp, 8
mov ecx, 0xc972d8
push 1
call fcn.00a5c911
call dword [sym.imp.UxTheme.dll_GetThemeBackgroundContentRect]
test al, al
je 0xb24b30
mov ebx, 2
cmp byte [0xc96afe], 0
jne 0xa5e777
sub esp, 8
mov ecx, 0xc97260
push 0
call fcn.00a8f7ab
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10
push 0x9f04fc
push 0x9f0660
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jg 0xb24b3a
js 0xa5e777
cmp dword [ebp - 0xc], 0
je 0xa5e777
mov al, 1
test edi, edi
je 0xa5e76a
mov dword [edi], ebx
test esi, esi
je 0xa5e770
mov byte [esi], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0xa5e764
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, eax
call fcn.00bac7eb
mov ebx, eax
neg ebx
sbb ebx, ebx
add ebx, 5
jmp 0xa5e777
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xa5e6e4
mov ebx, 3
jmp 0xa5e712
mov ebx, 1
jmp 0xa5e71b
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xa5e75a
Function at 0xa69360
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0xc9586c], 0
push esi
mov esi, ecx
je 0xa69422
cmp dword [esi + 8], 0
ja 0xa69437
inc dword [esi]
cmp dword [esi], 0x708
jae 0xb26f26
cmp dword [esi + 4], 0
je 0xa69466
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0xa6940f
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0x18]
jne 0xa69416
inc dword [esi + 0x14]
push edi
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov edi, eax
sub edi, dword [ebp - 0xc]
cmp edi, dword [esi + 4]
jb 0xa693d5
cmp byte [esi + 0x1c], 0
je 0xa694a7
cmp edi, dword [esi + 0xc]
pop edi
jae 0xa694f8
mov eax, dword [esi + 0x14]
push 0
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push dword [0x9f0760]
push dword [0x9f075c]
call dword [sym.imp.ntdll.dll_RtlPublishWnfStateData]
mov esi, eax
or esi, 0x10000000
jl 0xb26fca
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
jmp 0xa693ba
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [esi + 0x10], eax
mov byte [0xc9586c], 1
jmp 0xa69378
push 0x3e8
push 0
push 0x3e8
push dword [esi + 0x20]
push dword [0xc95994]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetCoalescableTimer]
test eax, eax
je 0xb26f0f
mov dword [esi + 8], 0
jmp 0xa69382
mov al, byte [esi + 0x1d]
test al, al
jne 0xb26f4d
mov ecx, 0x7530
mov dword [esi + 4], ecx
test al, al
jne 0xb26f57
mov eax, 0x9ee308
lea ecx, [ebp - 4]
mov edx, 0x9f05b0
push ecx
push eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00a5d071
test eax, eax
js 0xa6939a
jmp 0xb26f61
mov ecx, 0xc969e0
mov byte [esi + 0x1c], 1
call fcn.00a486e3
cmp eax, 5
jne 0xa6950c
cmp dword [0xc96a44], 0
jne 0xa69516
mov al, 1
test al, al
je 0xa693d5
lea edx, [esi + 0x1d]
mov ecx, esi
call fcn.00a4682a
call fcn.00a48378
test eax, eax
js 0xb26f82
xor cl, cl
call fcn.00a46eaf
test eax, eax
jns 0xa693d5
jmp 0xb26f9a
mov ecx, esi
call fcn.00a467e3
test eax, eax
jns 0xa693df
jmp 0xb26fb2
cmp eax, 6
je 0xa694ba
jmp 0xb26f74
xor al, al
jmp 0xa694c5
mov ecx, dword [ebp + 4]
mov edx, 0x56
push 0x9faba0
call fcn.00b6203c
jmp 0xa6945a
mov ecx, esi
call fcn.00a467e3
test eax, eax
jns 0xa69390
mov ecx, dword [ebp + 4]
mov edx, 0x5e
push eax
push 0x9faba0
call fcn.00ab606d
jmp 0xa69390
mov ecx, 0x1f40
jmp 0xa69476
mov eax, 0xa18ff8
jmp 0xa69486
mov eax, dword [ebp - 4]
test eax, eax
je 0xa6939a
mov dword [esi + 4], eax
jmp 0xa6939a
cmp eax, 7
je 0xa694ba
jmp 0xa69516
mov ecx, dword [ebp + 4]
mov edx, 0x8e
push eax
push 0x9faba0
call fcn.00ab606d
jmp 0xa694e4
mov ecx, dword [ebp + 4]
mov edx, 0x8f
push eax
push 0x9faba0
call fcn.00ab606d
jmp 0xa693d5
mov ecx, dword [ebp + 4]
mov edx, 0x95
push eax
push 0x9faba0
call fcn.00ab606d
jmp 0xa693df
mov ecx, dword [ebp + 4]
mov edx, 0x6e
push esi
push 0x9f0258
call fcn.00aa4c55
mov ecx, dword [ebp + 4]
mov edx, 0x97
push esi
push 0x9faba0
call fcn.00ab606d
jmp 0xa6940f
Function at 0xa756bf
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xafbb68
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0xc940a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [0xc97180]
mov dword [edi + 8], 1
mov dword [edi], 0x9d2f70
test ecx, ecx
jne 0xb2ab78
xor eax, eax
mov dword [edi], 0x9d2f80
or dword [edi + 0x28], 0xffffffff
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x2c], eax
mov eax, edi
mov byte [edi + 0x30], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xa75702
Function at 0xa7608c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x20
mov eax, 0xafd731
call fcn.00af8df7
mov esi, ecx
cmp byte [esi + 0x19], 0
mov dword [ebp - 0x20], 8
jne 0xa7612d
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0xa7612d
push 4
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x10
call dword [sym.imp.api_ms_win_power_base_l1_1_0.dll_CallNtPowerInformation]
test eax, eax
js 0xa760d9
test byte [ebp - 0x18], 2
jne 0xa7618f
cmp byte [ebp + 8], 0
jne 0xb2ad55
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [esi + 0x1c]
setb bl
xor eax, eax
mov edi, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp bl, byte [esi + 0x18]
jne 0xa76135
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0xa76196
test edi, edi
jne 0xa761ae
call fcn.00af8dc0
ret 4
test bl, bl
jne 0xb2ad66
cmp dword [esi + 0x24], 0
je 0xa7616f
cmp dword [esi + 0x40], 0
je 0xa7616f
cmp dword [esi + 0x20], 0
je 0xa7616f
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, dword [esi + 0x20]
lea ecx, [ebp - 0x2c]
push 0xffffffffffffffff
push dword [esi + 0x40]
mov dword [ebp - 0x14], eax
call fcn.00a56c40
and dword [esi + 0x20], 0
mov edi, dword [ebp - 0x2c]
mov eax, dword [esi + 0x1c]
mov byte [esi + 0x18], bl
test bl, bl
jne 0xa7617c
imul eax, eax, 5
push eax
push 0x12c
push dword [esi + 0x10]
push 0
call dword [sym.imp.api_ms_win_core_threadpool_legacy_l1_1_0.dll_ChangeTimerQueueTimer]
jmp 0xa76114
mov bl, 1
jmp 0xa760f2
test edi, edi
je 0xa7612d
push eax
push edi
push 2
pop edx
mov ecx, 0x9ee068
call fcn.00a38092
jmp 0xa76125
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xa7612d
xor bl, bl
cmp dword [ebp - 0x1c], 0
je 0xa760f2
jmp 0xa760e3
cmp dword [esi + 0x40], 0
je 0xa7616f
cmp dword [esi + 0x24], 0
je 0xa7616f
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [esi + 0x20], eax
jmp 0xa7616f
Function at 0xa79f94
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
cmp byte [0xc958cd], 0
je 0xa79fae
mov eax, esi
pop esi
pop ebx
leave
ret
call fcn.00ab20ff
mov esi, eax
test esi, esi
js 0xa79fa8
cmp byte [0xc958cd], 0
jne 0xa7a04c
mov esi, 0x9ee3c0
mov bl, 1
push esi
push 1
push 0xf001f
xor bh, bh
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
test eax, eax
je 0xb2c706
mov dword [0xc958c8], eax
mov byte [0xc958cc], bl
movzx eax, byte [0xc958cc]
neg eax
push 8
sbb eax, eax
push 0
and eax, 0xf001b
push 0
add eax, 4
push eax
push dword [0xc958c8]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [0xc958d0], eax
cmp dword [0xc958d0], 0
je 0xa7a06a
xor esi, esi
test bh, bh
jne 0xb2c73b
call fcn.00ab2edc
test eax, eax
jne 0xb2c793
call fcn.00a7f350
call fcn.00ab280d
mov byte [0xc958cd], 1
cmp dword [0xc96f78], 0
je 0xa79fa8
push dword [0xc96f78]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
jmp 0xa79fa8
mov esi, 0x80004005
jmp 0xa7a04c
push esi
push 1
push 4
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
xor bl, bl
test eax, eax
jne 0xa79fe5
push esi
push 8
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
inc bl
mov bh, bl
test eax, eax
je 0xa7a06a
jmp 0xa79fe5
mov ecx, dword [0xc958d0]
call fcn.00a7f3a9
call fcn.00c018d9
test al, al
jne 0xa7a02e
lea ecx, [ebp - 8]
call fcn.00aa25f0
test eax, eax
js 0xa7a02e
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
test eax, eax
je 0xb2c785
mov ecx, dword [ebp - 4]
call fcn.00c01c39
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xa7a02e
mov eax, dword [0xc95880]
mov dword [0xc95888], eax
mov eax, dword [0xc95884]
mov dword [0xc9588c], eax
jmp 0xa7a03b

Function at 0xa7a0b0
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add ecx, 0xfffffff0
pop ebp
jmp fcn.00a78564
Function at 0xa7d195
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push 0x20010010
push 0x9f1ee0
push 0x9f1e60
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp dword [ebp - 8], esi
jne 0xb3b0f5
push edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
mov ecx, dword [ebp - 8]
xor edi, edi
or edi, dword [ebp - 0xc]
or ecx, esi
mov edx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x24]
add edx, 0x61c46800
adc eax, 8
cmp ecx, eax
ja 0xa7d204
jb 0xa7d20b
cmp edi, edx
jb 0xa7d20b
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
xor esi, esi
inc esi
jmp 0xa7d204
push ecx
push ecx
push 1
mov ecx, 0xc964e8
call fcn.00b8711d
xor eax, eax
jmp 0xa7d207

Function at 0xa7dcec
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [edi + 4]
mov dword [edi], esi
push eax
push 0x20019
push esi
push 0x9f3c18
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xa7dd20
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
xor esi, esi
inc esi
mov dword [edi], esi
jmp 0xa7dd18

Function at 0xa7f3a9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0xc96f7c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0xb18fd9
push 0x20019
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 4
call fcn.00a7f468
mov eax, dword [0xc97ae0]
test eax, eax
jne 0xa7f3e3
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push edi
push 0
push 0x10
push 0x9ee90c
push 0x9ee878
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
mov ebx, 0x80070000
test esi, esi
jg 0xa7f458
js 0xa7f43a
mov ecx, dword [0xc97ae0]
test ecx, ecx
jne 0xa7f417
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 4]
push eax
push 0
push 0x10
push 0x9ee8ec
push 0x9ee878
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jg 0xa7f461
cmp dword [ebp - 0xc], 0
je 0xa7f449
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
js 0xb18fe8
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
movzx esi, si
or esi, ebx
test esi, esi
jmp 0xa7f408
movzx esi, si
or esi, ebx
jmp 0xa7f43a
lea edx, [edi + 4]
call fcn.00c01732
mov esi, eax
jmp 0xa7f449
mov ecx, edi
call fcn.00a7f48a
mov esi, eax
test esi, esi
js 0xa7f451
mov ecx, edi
call fcn.00c01e60
jmp 0xa7f451
Function at 0xa80e9e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x418]
push eax
push ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowThreadProcessId]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x418]
cmp ecx, eax
jne 0xb1c4a6
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
push edi
xor bl, bl
mov dword [ebp - 0x420], 0xa1be50
xor edi, edi
push esi
test bl, bl
jne 0xb1c57e
push ecx
push 0
push 0x1000
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0xb1c55b
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push esi
call dword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_QueryFullProcessImageNameW]
test eax, eax
je 0xb1c4ff
xor eax, eax
jmp 0xb1c51a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xb1c513
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xb1c51a
mov eax, 0x80004005
test eax, eax
js 0xb1c55b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + edi*4 - 0x420]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0xb1c55b
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
sete bl
mov ecx, esi
call fcn.00aae35d
test al, al
jne 0xb1c56d
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
inc edi
cmp edi, 1
jae 0xb1c57e
mov ecx, dword [ebp - 0x418]
jmp 0xb1c4b6
pop esi
pop edi
jmp 0xa80ed8

Function at 0xa81d28
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xc96e60]
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
xor esi, esi
test edi, edi
je 0xa81d5a
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 2
push esi
push esi
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0xa81d89
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0xa81d74
xor esi, esi
inc esi
test edi, edi
je 0xa81d81
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret 0xc
xor eax, eax
jmp 0xa81d83

Function at 0xa82a69
Capabilities:
Hide graphical window

Disassembly:
cmp byte [0xc96afe], 0
push esi
mov esi, ecx
jne 0xa82a91
push 5
push dword [esi + 0x2c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ShowWindow]
push 0
mov ecx, esi
call fcn.00a82a37
mov ecx, esi
pop esi
jmp fcn.00a82a95
push 0
jmp 0xa82a77
Function at 0xa84a83
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 9
push ebx
push 0x9ef970
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xb1d7ae
mov eax, ebx
pop ebx
leave
ret 4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0xb1d7d1
xor ebx, ebx
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xa84aac

Function at 0xa84ab3
Capabilities:
Persist via run registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea edx, [ebp - 4]
xor esi, esi
call fcn.00a849b4
test eax, eax
js 0xa84b2c
cmp dword [ebp - 4], 1
ja 0xa84b2c
push edi
push 0x40000048
call dword [sym.imp.SHELL32.dll_SHRestricted]
push ecx
mov edi, eax
call fcn.00a84a83
test eax, eax
jne 0xa84b31
test edi, edi
jne 0xa84b2b
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x9efa30
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xa84b2b
push esi
lea eax, [ebp - 8]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHQueryInfoKeyW]
test eax, eax
jne 0xa84b22
cmp dword [ebp - 8], esi
ja 0xa84b36
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
xor esi, esi
inc esi
jmp 0xa84b2b
xor esi, esi
inc esi
jmp 0xa84b22
Function at 0xa89fb9
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x32
xor ebx, ebx
lea edx, [ebp - 1]
pop ecx
mov byte [ebp - 1], bl
call fcn.00a8c455
lea eax, [ebp - 8]
cmp byte [ebp - 1], bl
jne 0xb2d772
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push ebx
push 0x9f0528
push reloc.SHCORE.dll_Ordinal_1
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp byte [ebp - 0x14], 0
je 0xa8a030
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0xb2d7e9
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
test bl, bl
je 0xa8a04a
push 0x9f03a4
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, eax
je 0xb2d806
cmp dword [ebp - 8], 0
je 0xa8a059
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
push eax
mov esi, 0x9f0528
mov edi, reloc.SHCORE.dll_Ordinal_1
push 0x9f0378
mov edx, esi
mov ecx, edi
call fcn.00a5d071
cmp eax, 0x80070002
jne 0xa8a059
lea eax, [ebp - 8]
mov edx, esi
push eax
push 0x9f03a4
mov ecx, edi
call fcn.00a5d071
cmp eax, 0x80070002
jne 0xa8a059
push ecx
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 4
push 0x9f03a4
mov edx, esi
mov ecx, edi
call fcn.00b6073b
push 0x9ef6fc
push ebx
push 0x1a
push 0xffff
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendNotifyMessageW]
jmp 0xa8a059
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0xa8a02b
push 0x9ef6fc
push 0
push 0x1a
push 0xffff
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendNotifyMessageW]
jmp 0xa8a04a