joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10335f4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0x208
mov dword [ebp - 4], 1
call sym.spoolsv.exe_PrvDllAllocSplMem
xor esi, esi
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x10336a7
lea eax, [ebp - 8]
push eax
push 0x2001f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, esi
je 0x103363e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x103369a
push edi
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
jmp 0x1033659
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.010335f4
mov dword [ebp - 4], eax
cmp eax, esi
je 0x1033675
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x104
push esi
push dword [ebp - 8]
call edi
test eax, eax
je 0x1033647
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
pop edi
cmp dword [ebp - 4], esi
je 0x103369d
cmp eax, esi
jne 0x103369a
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
test eax, eax
je 0x103369d
mov dword [ebp - 4], esi
push dword [ebp - 0xc]
call sym.spoolsv.exe_PrvDllFreeSplMem
jmp 0x10336b2
push 8
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 4], esi
pop esi
jne 0x10336e8
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x10336e8
test byte [eax + 0x1c], 1
je 0x10336e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1049104]
push 0x1022620
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x1033928
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
push 0x57
pop ebx
cmp dword [ebp + 8], esi
je 0x1033995
cmp dword [ebp + 0xc], esi
je 0x1033995
cmp dword [ebp + 0x10], esi
je 0x1033995
mov edi, dword [ebp + 0x14]
cmp edi, esi
je 0x1033995
lea eax, [ebp + 0x14]
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp + 8]
mov dword [edi], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x1033995
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 4
push dword [ebp + 0x14]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push dword [ebp + 0x14]
mov ebx, eax
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, esi
je 0x10339ba
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x10339ba
test byte [eax + 0x1c], 1
je 0x10339ba
push ebx
push 0x1022620
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10
Function at 0x10339c8
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push 0x57
pop edi
cmp dword [ebp + 8], esi
je 0x1033a28
cmp dword [ebp + 0xc], esi
je 0x1033a28
cmp dword [ebp + 0x10], esi
je 0x1033a28
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1033a28
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp edi, esi
je 0x1033a4d
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x1033a4d
test byte [eax + 0x1c], 1
je 0x1033a4d
push edi
push 0x1022620
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
mov eax, edi
pop edi
pop esi
leave
ret 0x10

Function at 0x1033a5a
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1033ab5
call fcn.0100ce3b
mov esi, eax
cmp esi, ebx
jl 0x1033ae5
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1033ad2
call fcn.0100ce3b
mov esi, eax
cmp esi, ebx
jl 0x1033adc
xor eax, eax
cmp dword [ebp - 0x14], ebx
sete al
mov esi, eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01003279
leave
ret
Function at 0x1036c1f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
xor edx, edx
mov word [ebp - 0x20c], dx
lea edx, [ebp - 0x210]
push edx
push 0x20019
xor edi, edi
push edi
push ecx
push eax
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1036cca
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x1024110
push dword [ebp - 0x210]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1036cca
push esi
push dword [ebp - 0x210]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov esi, dword [0x10491bc]
jmp 0x1036cc1
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1036cc5
mov esi, dword [esi]
cmp esi, edi
jne 0x1036ca9
mov eax, esi
pop esi
jmp 0x1036ce7
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x210], edi
je 0x1036ce5
push dword [ebp - 0x210]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01003279
leave
ret 8
Function at 0x1036d41
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
cmp esi, ebx
je 0x1036db1
cmp word [esi], di
je 0x1036dae
push esi
push dword [ebp + 8]
call fcn.01036c1f
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.01036cfb
test eax, eax
je 0x1036e20
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1036d81
sub eax, edx
sar eax, 1
lea ebx, [ebx + eax*2 + 2]
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1036d98
sub eax, ecx
sar eax, 1
lea esi, [esi + eax*2 + 2]
test esi, esi
jne 0x1036d5c
mov edi, dword [ebp - 4]
mov eax, dword [0x10491bc]
inc ebx
inc ebx
xor edx, edx
jmp 0x1036dbf
mov eax, dword [eax]
inc edx
test eax, eax
jne 0x1036dbc
xor esi, esi
inc esi
mov ecx, esi
mov eax, edi
test edi, edi
je 0x1036dd5
mov eax, dword [eax]
inc ecx
test eax, eax
jne 0x1036dce
cmp ecx, edx
jne 0x1036e1c
push ebx
push dword [ebp + 0xc]
push 7
push 0
push 0x1013370
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x1036dfc
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1036e2d
mov eax, dword [0x10491bc]
mov ecx, edi
test edi, edi
je 0x1036e14
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov ecx, dword [ecx]
mov eax, edx
test ecx, ecx
jne 0x1036e07
and dword [eax], 0
mov dword [ebp - 8], esi
jmp 0x1036e2d
push 0x57
jmp 0x1036df4
mov edi, dword [ebp - 4]
jmp 0x1036e2d
mov edi, dword [edi]
push eax
call sym.spoolsv.exe_PrvDllFreeSplMem
mov eax, edi
test edi, edi
jne 0x1036e25
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1036e42
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call sym.spoolsv.exe_PrvWaitForSpoolerInitialization
push 0x1049318
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x1036fba
cmp word [esi], bx
je 0x1036fba
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x3001f
push ebx
push ebx
push ebx
push 0x1012658
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x1036ea7
push eax
jmp 0x1036fbc
push esi
push dword [ebp - 4]
call fcn.01036c1f
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x1036fc2
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
mov esi, 0x1013370
push esi
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call edi
cmp eax, ebx
jne 0x1036ea1
cmp dword [ebp - 8], ebx
je 0x1036fc2
push dword [ebp - 8]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x1036fc2
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push ebx
push ebx
push esi
push dword [ebp - 4]
call edi
cmp eax, ebx
jne 0x1036ea1
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.01033b98
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1036fc2
push dword [ebp - 0x18]
push eax
push 7
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
cmp eax, ebx
jne 0x1036ea1
push dword [ebp + 0x10]
push 0x1024220
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
mov edi, 0x1037018
test eax, eax
jne 0x1036f73
lea eax, [ebp - 0x20]
push eax
push 0x1037054
push edi
push dword [ebp - 4]
call fcn.01033928
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x1036f75
mov esi, ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.010335f4
cmp esi, ebx
je 0x1036f95
push dword [ebp - 0x20]
push 0x1037054
push edi
push dword [ebp - 4]
call fcn.010339c8
mov eax, dword [0x10491bc]
jmp 0x1036fa7
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
cmp ecx, edx
je 0x1036fad
mov eax, ecx
cmp dword [eax], ebx
je 0x1036fb1
jmp 0x1036f9c
mov ecx, dword [edx]
mov dword [eax], ecx
mov dword [ebp - 0x14], 1
jmp 0x1036fd4
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1036fd4
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0xc], ebx
je 0x1036fe1
push dword [ebp - 0xc]
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [ebp - 0x10], ebx
je 0x1036fee
push dword [ebp - 0x10]
call sym.spoolsv.exe_PrvDllFreeSplMem
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x1036fff
push dword [ebp - 4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
push 0x1049318
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x14]
leave
ret 0xc
Function at 0x1039370
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
cmp esi, edi
je 0x1039521
cmp dword [esi], 0x6060
jne 0x1039521
mov eax, dword [ebp + 0x10]
dec eax
je 0x10393b3
push 0x7c
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1039433
push 0xc
pop ebx
cmp dword [ebp + 0x18], ebx
jae 0x10393ca
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0x1c]
mov dword [eax], ebx
jmp 0x1039433
mov ebx, dword [ebp + 0x14]
cmp ebx, edi
jne 0x10393d5
push 0x57
jmp 0x10393a8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x1039433
mov edx, dword [esi + 4]
mov eax, dword [0x10491bc]
cmp edx, eax
je 0x103944e
mov ecx, dword [esi + 0x1c]
cmp ecx, 0xffffffff
je 0x103944a
push 2
pop edi
push edi
xor esi, esi
inc esi
push esi
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1039423
mov eax, dword [ebp - 4]
mov dword [ebx], esi
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
xor edi, edi
cmp dword [ebp - 8], edi
je 0x1039433
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], edi
pop edi
pop esi
pop ebx
je 0x1039443
push dword [ebp - 0x10]
call sym.spoolsv.exe_PrvDllFreeSplMem
mov eax, dword [ebp - 0xc]
leave
ret 0x18
cmp edx, eax
jne 0x1039479
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
push dword [ebp - 8]
push ecx
push edi
push dword [esi + 8]
call dword [eax + 0x150]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x1039425
mov eax, dword [ebp - 4]
xor esi, esi
inc esi
mov dword [ebx], esi
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
jmp 0x1039425
push edi
push edi
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
call dword [eax + 0x150]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x1039425
call sym.spoolsv.exe_PrvRevertToPrinterSelf
push 0x208
mov dword [ebp + 8], eax
call sym.spoolsv.exe_PrvDllAllocSplMem
mov dword [esi + 0x20], eax
cmp eax, edi
je 0x1039508
push eax
push edi
push 0x1039530
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1039508
push edi
push edi
push 2
pop edi
push edi
push 0
push 3
push 0xc0000000
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x1c], eax
cmp eax, 0xffffffff
je 0x1039506
push edi
xor esi, esi
inc esi
push esi
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1039506
mov eax, dword [ebp - 4]
mov dword [ebx + 8], edi
mov dword [ebx], esi
mov dword [ebx + 4], eax
xor edi, edi
jmp 0x103950b
xor edi, edi
mov dword [ebp - 0xc], edi
cmp dword [ebp + 8], edi
je 0x1039425
push dword [ebp + 8]
call sym.spoolsv.exe_PrvImpersonatePrinterClient
jmp 0x1039425
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1039425
Function at 0x103a699
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 4], 0x7b
call sym.spoolsv.exe_PrvWaitForSpoolerInitialization
cmp dword [ebp + 8], 0
je 0x103a6c1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x103a798
push edi
push 0xc
call sym.spoolsv.exe_PrvDllAllocSplMem
mov edi, eax
test edi, edi
jne 0x103a6fa
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x103a6f3
test byte [eax + 0x1c], 1
je 0x103a6f3
push 0x10241c0
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245a6
xor eax, eax
jmp 0x103a797
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [0x10491bc]
and dword [ebx], 0
jmp 0x103a73f
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push 0
call dword [esi + 0x108]
mov dword [ebp + 8], eax
cmp eax, 1
je 0x103a79c
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0101979e
cmp dword [ebp + 8], 2
je 0x103a743
mov esi, dword [esi]
test esi, esi
jne 0x103a70a
push edi
call sym.spoolsv.exe_PrvDllFreeSplMem
lea eax, [ebp - 4]
push eax
push 0x709
call fcn.0101979e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x103a793
test byte [eax + 0x1c], 1
je 0x103a793
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0xc]
mov eax, dword [0x1049104]
push 0x10241c0
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0103a7c4
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 0x14
mov dword [edi], 0x6262
mov dword [edi + 4], esi
mov eax, dword [ebp - 8]
mov dword [edi + 8], eax
mov dword [ebx], edi
mov eax, dword [0x10491d0]
test eax, eax
je 0x103a7ba
mov byte [eax + 0x40], 0
xor eax, eax
inc eax
jmp 0x103a795

Function at 0x103c3d9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x418], ecx
mov eax, 0x80070057
test ecx, ecx
je 0x103c497
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x1011218
push dword [edi + 4]
mov dword [ebp - 0x41c], 0x40e
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x103c48b
lea eax, [ebp - 0x414]
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x103c46e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
jmp 0x103c497
jle 0x103c497
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01003279
leave
ret 8
Function at 0x103ca67
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ecx, dword [ebp + 8]
lea edi, [ebp - 0x434]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ebx, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueW]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x41c]
push eax
xor edi, edi
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x418], edi
push ecx
jmp 0x103cba5
cmp word [ebp - 0x20c], di
je 0x103cb75
lea eax, [ebp - 0x20c]
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x103cb75
xor eax, eax
mov word [esi], ax
inc esi
inc esi
cmp word [esi], 0x20
je 0x103caf4
push 2
push 0x103cbe0
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x103cb75
add esi, 4
push esi
mov word [esi + 4], ax
call fcn.0103ca00
mov esi, dword [ebp + 0xc]
lea edx, [ebp - 0x414]
mov di, word [edx]
cmp di, word [esi]
jne 0x103cb4d
test di, di
je 0x103cb49
mov di, word [edx + 2]
cmp di, word [esi + 2]
jne 0x103cb4d
add edx, 4
add esi, 4
test di, di
jne 0x103cb27
xor edx, edx
jmp 0x103cb52
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x103cbcf
cmp eax, 0x64
jae 0x103cb73
mov ecx, eax
shr ecx, 5
lea edx, [ebp + ecx*4 - 0x434]
mov ecx, eax
xor eax, eax
and ecx, 0x1f
inc eax
shl eax, cl
or dword [edx], eax
xor edi, edi
inc dword [ebp - 0x418]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
push dword [ebp - 0x424]
mov dword [ebp - 0x420], 0x104
mov dword [ebp - 0x41c], 0x208
call ebx
test eax, eax
je 0x103cac7
lea eax, [ebp - 0x434]
push eax
call fcn.0103ca35
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01003279
leave
ret 8
Function at 0x103d134
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 3
cmp esi, edi
je 0x103d27e
cmp dword [ebp + 0xc], edi
je 0x103d27e
cmp dword [ebp + 0x10], edi
je 0x103d27e
push ebx
push 0x2001f
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x103d18c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x103d266
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x103d258
cmp word [eax], 0x5c
jne 0x103d258
cmp word [eax + 2], 0x5c
jne 0x103d258
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
call fcn.0103d064
mov ebx, eax
cmp ebx, edi
jne 0x103d25d
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
mov edi, 0x103d290
push edi
push dword [ebp - 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x103d24b
cmp dword [ebp - 0x10], 3
jne 0x103d248
push dword [ebp - 4]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
jne 0x103d205
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x103d24b
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push dword [ebp - 8]
call esi
mov ecx, dword [ebp + 0x10]
mov ebx, eax
mov eax, dword [ebp - 4]
add eax, 3
and eax, 0xfffffffc
mov dword [ecx], eax
xor eax, eax
test ebx, ebx
sete al
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x103d24b
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x103d24b
push eax
call sym.spoolsv.exe_PrvDllFreeSplMem
and dword [esi], 0
jmp 0x103d24b
push 0xd
pop ebx
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
xor edi, edi
jmp 0x103d25d
mov ebx, 0x709
push dword [ebp - 0x14]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, edi
pop ebx
je 0x103d286
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0103cf97
mov dword [ebp - 0xc], eax
jmp 0x103d286
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 0xc