joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbab1bb
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [0xd08954]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push esi
call fcn.00bab638
cmp eax, 0xd
jb 0xbf5746
call fcn.00baac3a
mov ecx, dword [esp + 0x434]
pop esi
pop ebx
xor ecx, esp
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
mov ebx, reloc.SHCORE.dll_Ordinal_1
push 4
pop esi
test eax, eax
jne 0xbf57ca
push 0xb3e8cc
mov eax, 0x104
push 0xb288f0
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x22c]
push eax
lea eax, [esp + 0x24]
push eax
push 0xb3e8e8
lea eax, [esp + 0x30]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
jne 0xbf57c6
cmp word [esp + 0x228], ax
je 0xbf57c6
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
push eax
push esi
push 0xb3e8fc
push 0xb28430
push ebx
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
xor cl, cl
jmp 0xbf57cc
mov cl, 1
call fcn.00c73870
call fcn.00c7459e
call fcn.00c73440
call fcn.00c7315c
call fcn.00c730bb
call fcn.00c285b6
call fcn.00c74e46
push 0
push 0xb284a8
push 3
pop edx
mov ecx, 0xb472f8
call fcn.00b80eb2
push 0xb2a5e4
push 0xb2a0c0
push ebx
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
and dword [esp + 0x10], 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], esi
push eax
push 0
push 0x18
push 0xb3e91c
push 0xb2da60
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
test eax, eax
jne 0xbf584e
cmp dword [esp + 0x10], eax
jne 0xbab1e7
push esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0xd
push eax
push esi
push 0xb29b2c
push 0xb28430
push ebx
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
jmp 0xbab1e7

Function at 0xbab31a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push 0xb29a90
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xbab373
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xb29a7c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0xbf5c46
cmp dword [ebp - 4], 0
je 0xbab382
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x10], 4
jne 0xbab373
mov esi, dword [ebp - 8]
jmp 0xbab373
Function at 0xbab5cf
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0xd0ad78]
test ecx, ecx
je 0xbab605
xor eax, eax
inc eax
cmp ecx, eax
je 0xbab5f7
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0x202
push eax
lea eax, [ebp - 0x408]
push eax
push 0xc
call dword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
jne 0xbf5ce4
push 2
pop ecx
mov dword [0xd0ad78], ecx
jmp 0xbab5ee
xor eax, eax
inc eax
mov dword [0xd0ad78], eax
jmp 0xbab5f7

Function at 0xbab81e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 4
pop edi
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push 0xb29bec
push 0xb29680
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
cmp eax, 2
je 0xbf62f1
cmp eax, 3
je 0xbf62f1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x1d
call dword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
test eax, eax
je 0xbf63b4
push 0x220
push esi
call dword [sym.imp.SHELL32.dll_SHTestTokenMembership]
xor ebx, ebx
inc ebx
test eax, eax
jne 0xbf6369
push 0x225
push esi
call dword [sym.imp.SHELL32.dll_SHTestTokenMembership]
test eax, eax
jne 0xbf6369
push 0x227
push esi
call dword [sym.imp.SHELL32.dll_SHTestTokenMembership]
test eax, eax
jne 0xbf6369
push 0x22c
push esi
call dword [sym.imp.SHELL32.dll_SHTestTokenMembership]
test eax, eax
jne 0xbf6369
lea edx, [ebp - 0xc]
mov dword [ebp - 4], esi
call fcn.00b91952
test eax, eax
jne 0xbf636c
mov eax, dword [ebp - 0xc]
test eax, eax
je 0xbf6369
cmp eax, ebx
je 0xbf6369
cmp eax, 0x10
je 0xbf6369
cmp eax, 0x11
jne 0xbf636c
mov dword [ebp - 4], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xb3e324
mov esi, 0xb29680
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
cmp eax, 2
je 0xbf6398
cmp eax, 3
jne 0xbf63bc
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push edi
push 0xb3e324
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
jmp 0xbf63bc
mov dword [ebp - 4], esi
mov esi, 0xb29680
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0xb29bec
push esi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
pop ebx
jmp 0xbab860
Function at 0xbabb32
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x21c], eax
test edi, edi
jne 0xbf9db4
push ecx
mov esi, 0x104
mov dword [eax], ebx
mov edx, esi
mov dword [eax + 4], ebx
lea ecx, [ebp - 0x20c]
call fcn.00b7db60
push 0xb2bdc0
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00b80376
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
je 0xbf9dbb
lea edx, [ebp - 0x214]
mov dword [ebp - 0x214], ebx
mov ecx, esi
call fcn.00babc13
mov dword [ebp - 0x218], eax
test eax, eax
js 0xbf9de0
mov eax, dword [ebp - 0x214]
cdq
mov ecx, eax
test edi, edi
jne 0xbabc0e
mov eax, dword [ebp - 0x21c]
mov dword [eax], ecx
mov dword [eax + 4], edx
test esi, esi
je 0xbabbf9
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0xbf9e04
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8
mov byte [edi], 1
jmp 0xbabbdb
mov byte [edi], bl
jmp 0xbabb60
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0xbabbe6
mov ecx, dword [ebp + 4]
mov edx, 0xc8
push 0xb2f0d0
call fcn.00c206ae
mov ebx, eax
jmp 0xbf9df9
mov ecx, dword [ebp + 4]
mov edx, 0xce
push eax
push 0xb2f0d0
call fcn.00bc2921
mov ebx, dword [ebp - 0x218]
mov esi, dword [ebp - 0x210]
jmp 0xbabbe6
mov ecx, dword [ebp + 4]
mov edx, 0x878
push 0xb2f0f8
call fcn.00c20de0
int3
Function at 0xbabfa2
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
push 0xc
mov eax, dword [esi + 0x14]
mov edx, ebx
mov edi, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edi
movzx eax, word [eax + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
pop ecx
test eax, eax
jne 0xbfa118
mov eax, ebx
mov edi, ebx
test eax, eax
jne 0xbfa147
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 4]
movzx esi, word [esi + 6]
mov eax, dword [eax + 0x1c]
test esi, esi
jne 0xbfa22e
mov eax, edi
mov dword [ecx + 0x10], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, edi
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
cmp dword [eax], esi
mov esi, dword [ebp - 4]
jne 0xbfa1b3
cmp dword [ebp + 0xc], ebx
je 0xbfa19b
cmp dword [esi + 0x20], ebx
je 0xbfa19b
test byte [eax + 4], 1
jne 0xbfa1b3
imul esi, edx, 0xc
lea edi, [ebp - 0x24]
add esi, dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp + 0xc], ebx
je 0xbfa154
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], ebx
jne 0xbfa157
push 8
pop ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ecx + eax]
test al, 4
je 0xbfa16d
and edx, 0xffffcfff
mov dword [ebp - 0x20], edx
test al, 2
je 0xbfa17a
and edx, 0xfffff3ff
mov dword [ebp - 0x20], edx
test al, 1
je 0xbfa187
and edx, 0xfffffcff
mov dword [ebp - 0x20], edx
test al, 8
je 0xbfa1d7
and edx, 0xc0ffffff
mov esi, ebx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
jmp 0xbfa1da
test byte [eax + 4], 1
lea edi, [ebp - 0x24]
jne 0xbfa1c6
mov esi, eax
mov dword [ebp - 0x14], 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
inc edx
add eax, ecx
cmp edx, edi
jb 0xbfa11d
mov eax, dword [ebp - 0x14]
jmp 0xbabfdc
imul esi, edx, 0xc
xor eax, eax
add esi, dword [ebp - 0x10]
inc eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0xbabfdc
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
mov edi, ebx
call fcn.00c2122d
mov ecx, dword [ebp - 8]
test eax, eax
je 0xbabfe9
mov eax, edx
mov dword [ecx + 0xc], esi
shr eax, 0x1e
mov dword [ecx + 8], eax
mov eax, edx
shr eax, 0x18
and al, 0x3f
mov byte [ecx + 4], al
mov eax, edx
shr eax, 0xc
and eax, 3
jne 0xbfa224
mov eax, edx
shr eax, 0xa
and eax, 3
jne 0xbfa224
shr edx, 8
and edx, 3
je 0xbfa226
mov dword [ecx], edx
jmp 0xbfa226
mov dword [ecx], eax
xor edi, edi
inc edi
jmp 0xbabfe9
mov ecx, dword [ebp + 8]
cmp dword [eax], ecx
mov ecx, dword [ebp - 8]
je 0xbfa245
inc edx
add eax, 0x10
cmp edx, esi
jb 0xbfa22e
jmp 0xbac000
xor ebx, ebx
inc ebx
jmp 0xbac000
Function at 0xbb5bb7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xbb5bd8
sub ecx, edx
sar ecx, 1
cmp ecx, 0x27
jbe 0xbb5c4a
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.00bc1f59
test eax, eax
je 0xbb5c4a
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push esi
push 0x5000
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
test eax, eax
js 0xbb5c4a
lea eax, [edi + 0x4e]
push eax
push dword [ebp - 0x1c]
push 0x104
push ebx
call fcn.00bc1d4e
push dword [ebp - 0x1c]
mov esi, eax
call fcn.00bc1cf1
test esi, esi
js 0xbb5c4a
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
push edi
mov edx, 0x104
mov ecx, ebx
call fcn.00b7db60
mov esi, eax
jmp 0xbb5c35

Function at 0xbb7e07
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
push edi
push eax
lea eax, [ebp - 8]
mov byte [ebx], 0
push eax
xor edi, edi
mov dword [ebp - 4], 4
push edi
push 0x10
push 0xb2c5fc
push 0xb2c578
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jg 0xc169cd
js 0xc169dd
mov edi, dword [ebp - 8]
xor esi, esi
test esi, esi
js 0xc16a04
test edi, edi
setne al
mov byte [ebx], al
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx esi, si
or esi, 0x80070000
test esi, esi
jmp 0xbb7e4a
push 0xb2c5fc
push 0xb2c578
push 0xb45318
push esi
push 0xb30450
push 0x4f
push dword [ebp + 4]
call fcn.00caa094
add esp, 0x1c
jmp 0xbb7e55
push 0xb2c5fc
push 0xb2c578
push 0xb45318
push esi
push 0xb4804c
push 0x124
push dword [ebp + 4]
call fcn.00c44474
add esp, 0x1c
mov eax, esi
jmp 0xbb7e66

Function at 0xbb7e6f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
xor ecx, ecx
mov edi, 0xb2c5fc
push ecx
push ecx
push 0xffff
push edi
push 0xb2c578
push reloc.SHCORE.dll_Ordinal_1
mov byte [esi], cl
mov dword [ebp - 4], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test ebx, ebx
jg 0xc16a30
js 0xc16a40
shr ebx, 0x1f
xor bl, 1
xor eax, eax
mov byte [esi], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jmp 0xbb7ead
cmp ebx, 0x80070002
je 0xbb7eb3
push edi
push 0xb2c578
push 0xb45318
push ebx
push 0xb4804c
push 0xfd
push dword [ebp + 4]
call fcn.00caa094
add esp, 0x1c
mov eax, ebx
jmp 0xbb7ebd
Function at 0xbb810b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
mov edi, ecx
cmp dword [ebp + 8], esi
jbe 0xbb8136
movzx eax, byte [esi + edx]
add eax, dword [edi]
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
inc esi
mov dword [edi], eax
cmp esi, dword [ebp + 8]
jb 0xbb811b
pop edi
pop esi
pop ebp
ret 4
Function at 0xbb9922
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
or edi, 0xffffffff
mov dword [esi + 0x14], eax
test eax, eax
je 0xbb99d3
push ebx
push 1
xor edi, edi
mov ebx, 0xb28430
push edi
push 0xb2d258
push ebx
call dword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
neg eax
mov edx, 0xb2d220
push 0x1f4
sbb al, al
mov ecx, ebx
inc al
mov byte [esi + 0x53], al
call fcn.00b9e7ee
push esi
push dword [esi + 0x14]
mov dword [esi + 0x38], eax
call dword [sym.imp.ole32.dll_RegisterDragDrop]
push 0xc
xor ecx, ecx
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], edi
push eax
inc ecx
push ecx
push edi
push dword [esi + 0x14]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_SetGestureConfig]
mov ecx, esi
call fcn.00bb9849
mov ebx, dword [esi + 0x68]
add esi, 0x64
mov ecx, esi
call fcn.00ba85aa
mov eax, dword [ebx]
push esi
push ebx
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x14], eax
cmp eax, fcn.00ba5790
jne 0xc177b5
call fcn.00ba5790
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
mov ecx, eax
call dword [0xd0cffc]
call dword [ebp - 0x14]
jmp 0xbb99d2

Function at 0xbbac4a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0xc188f6
push ebx
push esi
push 0xc38d70
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolTimer]
mov dword [esi], eax
test eax, eax
je 0xc18928
mov edi, ebx
push 4
pop eax
cmp dword [esi + 8], ebx
jne 0xc1891a
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
push 8
push 0xb2d350
push 0xb28430
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
mov edi, dword [esp + 0xc]
test edi, edi
je 0xbbad0a
xor ebx, ebx
mov ecx, edi
cmp dword [esi + 8], 4
sete bl
dec ebx
and ebx, 0xfff7c2a0
add ebx, 0x927c0
mov edx, ebx
call fcn.00bbad4d
cmp dword [esi + 8], 0
jne 0xbbacf6
cmp eax, 0x927c0
jbe 0xbbacf6
mov dword [esi + 8], 4
mov ecx, dword [esi]
push ebx
push 0
push eax
call fcn.00bbad11
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00c35f03
jmp 0xbbacc3
push ebx
push ebx
push ebx
push dword [esi]
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolTimer]
push 1
push dword [esi]
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_WaitForThreadpoolTimerCallbacks]
push dword [esi]
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CloseThreadpoolTimer]
mov dword [esi], ebx
jmp 0xbbac64
cmp dword [esi + 8], eax
jne 0xbbad0a
jmp 0xbbac89
mov eax, 0x80004005
jmp 0xbbad03
Function at 0xbbb577
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0xbcc108
call fcn.00bc132b
xor eax, eax
mov bl, al
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], eax
call fcn.00b7a9bd
or dword [ebp - 0x224], 0xffffffff
lea edx, [ebp - 0x228]
or dword [ebp - 0x220], 0xffffffff
call fcn.00bbb6ba
mov ecx, dword [ebp + 4]
test eax, eax
js 0xc18b70
push 0x1c
pop ecx
mov esi, 0xb328b0
lea edi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
push 0x196
lea eax, [ebp - 0x1a6]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp - 0x228]
push 0x104
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
mov ecx, dword [ebp + 4]
test eax, eax
js 0xc18b77
and dword [ebp - 0x21c], 0
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x21c]
test edi, edi
jne 0xc18b8c
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x218]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jg 0xc18ba7
mov ecx, dword [ebp + 4]
test eax, eax
js 0xc18bb4
xor eax, eax
push eax
push eax
push eax
push eax
push 0xb2d398
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov byte [ebp - 4], 0
cmp dword [ebp - 0x21c], 0
je 0xbbb6a3
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00b7a9bd
mov al, bl
call fcn.00bc12da
ret
mov edx, 0x22f
jmp 0xc18b7c
mov edx, 0x232
push eax
push 0xb27854
call fcn.00b913f8
jmp 0xbbb6a3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0xbbb632
movzx eax, ax
or eax, 0x80070000
jmp 0xbbb661
push eax
push 0xb27854
mov edx, 0x235
call fcn.00b913f8
jmp 0xbbb68a
Function at 0xbbb98e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, ebx
mov ecx, dword [edi + 0xbc]
call fcn.00bbddef
test al, al
je 0xbbb9fb
push ebx
push ebx
push edi
push 0xbb6370
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov dword [edi + 0xbc], eax
test eax, eax
je 0xc18d09
test esi, esi
js 0xbbb9fb
push ebx
push edi
push 0xcb98b0
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWait]
mov dword [edi + 0xb8], eax
test eax, eax
je 0xc18d27
push ebx
push dword [edi + 0xbc]
mov esi, ebx
push eax
call dword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolWait]
mov dword [edi + 0xb8], ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc18d20
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xc18d44
jmp 0xbbb9c6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc18d3e
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xbbb9fb
mov esi, 0x80004005
jmp 0xbbb9fb

Function at 0xbbc90a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
lea esi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push eax
push 0x20019
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0xb2d558
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
js 0xbbc997
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 3
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push 0xb2d52c
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jle 0xbbc98b
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xbbc997
lea esi, [ebp - 0x34]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x1c], 0
lea esi, [ebp - 0x18]
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0xc19234
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor ecx, ebp
pop edi
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xbbc9ab
Function at 0xbbc9c0
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x1000b
push 0
mov esi, 0xb2d558
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push esi
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
js 0xbbc9f5
push esi
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
cmp dword [ebp - 4], 0
pop edi
pop esi
jne 0xc19242
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xbbca01

Function at 0xbbcd5a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
push edi
mov edi, edx
test ecx, ecx
je 0xc192bb
push esi
test edi, edi
je 0xbbcdd1
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xbbcda0
mov esi, ebx
push ebx
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0xbbcd8c
cmp dword [ebp + 8], ebx
je 0xbbcdd6
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
test edi, edi
je 0xbbcd8e
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xbbcd8e
mov dword [ebp - 4], ecx
jmp 0xbbcda7
xor esi, esi
inc esi
jmp 0xbbcdc4
push 0x57
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0xbbcd98