joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1169968c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1178ea63
call fcn.116e0880
sub esp, 0x84
push esi
push edi
push 0xffffffffffffffff
xor edi, edi
push 0xffffffffffffffff
push edi
mov esi, ecx
push edi
push edi
push edi
lea ecx, [ebp - 0x54]
call fcn.11698453
lea eax, [esi + 0x5c]
push 1
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.116b4600
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
mov ecx, dword [eax + ecx*4]
cmp dword [ecx + 0xc], edi
jne 0x116996f2
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.116b4660
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.116984de
jmp 0x11699814
push ebx
call fcn.1169aad7
mov edi, eax
lea ecx, [ebp - 0x54]
lea eax, [edi + 8]
push eax
call fcn.116995ce
push edi
lea ecx, [esi + 0x34]
call fcn.1169a83b
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.116b4660
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov ecx, dword [eax + 0x10]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x3c], ecx
push eax
lea ecx, [ebp - 0x90]
call fcn.11699824
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [ebp - 4], 2
call edi
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x90]
lea ecx, [esi + 0x140]
push eax
mov dword [ebp + 0xc], ecx
call fcn.1169a558
call edi
mov dword [ebp + 8], eax
mov eax, dword [0x117e1700]
test eax, eax
mov ebx, str.CTaskMgr2
mov esi, 0x117e0e6c
je 0x11699791
mov eax, dword [ebp - 0x24]
push dword [eax]
push dword [eax + 4]
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
push str.CTaskMgr2::_Dispose_start__Type__lu__Level__lu__Dispose_0x_x__0x_x_
push ebx
push 0xffffffffffffffff
push esi
call fcn.116deab0
add esp, 0x20
lea ecx, [ebp - 0x54]
call fcn.1169851d
call edi
sub eax, dword [ebp + 8]
cmp eax, 0x3e8
jb 0x116997be
cmp dword [0x117e1700], 0
je 0x116997e1
push eax
mov eax, dword [ebp - 0x24]
push dword [eax]
push dword [eax + 4]
push str.CTaskMgr2::_Dispose_end__Dispose_0x_x__0x_x__span__lu__
jmp 0x116997d5
cmp dword [0x117e1700], 0
je 0x116997e1
push eax
mov eax, dword [ebp - 0x24]
push dword [eax]
push dword [eax + 4]
push str.CTaskMgr2::_Dispose_end__Dispose_0x_x__0x_x__span__lu_
push ebx
push 0xffffffffffffffff
push esi
call fcn.116deab0
add esp, 0x1c
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x90]
push eax
call fcn.1169a5d7
lea ecx, [ebp - 0x54]
call fcn.11698675
and byte [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.116984de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.116984de
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x11699824
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1178ea7b
call fcn.116e0880
push ecx
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov dword [eax + 0xc], 0x11794840
mov edx, dword [ecx + 0x14]
and dword [ebp - 4], 0
mov dword [eax + 0x14], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x1c], edx
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x20], edx
mov edx, dword [ecx + 0x24]
mov dword [eax + 0x24], edx
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x28], edx
mov edx, dword [ecx + 0x2c]
mov dword [eax + 0x2c], edx
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
mov edx, dword [ecx + 0x34]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 0x34], edx
mov ecx, dword [ecx + 0x38]
mov dword [eax], 0x11794c60
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1169a3e2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea esi, [edi + 0xa4]
call ebp
cmp dword [esi - 0x10], 0
jg 0x1169a40d
mov ecx, dword [esi]
test ecx, ecx
je 0x1169a40d
sub eax, ecx
cmp eax, 0x493e0
ja 0x1169a418
inc ebx
add esi, 4
cmp ebx, 4
jb 0x1169a3f6
jmp 0x1169a429
call ebp
push eax
lea eax, [edi + ebx*4 + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1169b8c9
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1178ece8
call fcn.116e0880
sub esp, 0xe18
xor edx, edx
push ebx
cmp dword [0x117dfcbc], edx
push esi
push edi
jne 0x1169bad0
and byte [ebp - 0x41c], dl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x41b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xe22]
mov word [ebp - 0xe24], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x622]
mov word [ebp - 0x624], dx
rep stosd dword es:[edi], eax
push str.OAgent.ini
mov dword [0x117dfcbc], 1
mov dword [ebp - 0x10], edx
stosw word es:[edi], ax
call fcn.116736ee
push eax
lea eax, [ebp - 0x624]
push 0x117b01ec
push eax
call fcn.116e0f91
add esp, 0x10
lea eax, [ebp - 0x624]
mov esi, 0x400
mov ebx, 0x117d3ee4
push eax
lea eax, [ebp - 0xe24]
push esi
push eax
push ebx
push 0x11794cfc
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edi, edi
cmp eax, edi
jbe 0x1169b9b1
cmp word [ebp - 0x626], di
jne 0x1169b9b1
lea eax, [ebp - 0x41c]
push esi
push eax
lea eax, [ebp - 0xe24]
push eax
call fcn.116bb2c0
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jne 0x1169ba93
lea ecx, [ebp - 0x18]
call fcn.116b5210
push 0x20019
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push SysStringLen
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.116b5380
test eax, eax
mov edi, 0x11794d04
je 0x1169ba20
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
push edi
call fcn.116b57a0
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x1169ba20
cmp dword [ebp - 0x10], esi
jae 0x1169ba13
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.116e0a70
add esp, 0xc
jmp 0x1169ba17
and dword [ebp - 0x10], 0
push dword [ebp - 0x1c]
call fcn.116e0410
pop ecx
lea ecx, [ebp - 0x18]
call fcn.116b53d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.116b5300
cmp dword [ebp - 0x10], 0
jne 0x1169ba93
push 0x800
lea eax, [ebp - 0xe24]
push 0
push eax
call fcn.116e0420
add esp, 0xc
lea eax, [ebp - 0xe24]
push esi
push eax
push ebx
push edi
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
jbe 0x1169ba8d
cmp word [ebp - 0x626], 0
jne 0x1169ba8d
lea eax, [ebp - 0x41c]
push esi
push eax
lea eax, [ebp - 0xe24]
push eax
call fcn.116bb2c0
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1169bad0
cmp dword [ebp - 0x10], 4
jbe 0x1169bad0
lea eax, [ebp - 0x41c]
test eax, eax
je 0x1169bad0
cmp dword [ebp - 0x41c], 1
je 0x1169bad0
movzx eax, word [ebp - 0x400]
lea eax, [eax + eax + 0x22]
test eax, eax
je 0x1169bad0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffffc
cmp eax, ecx
ja 0x1169bad0
mov eax, dword [ebp - 0x414]
mov dword [0x117dfcb8], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1169cc13
Capabilities:
Start service

Disassembly:
push ecx
push esi
call fcn.116f3b00
test eax, eax
je 0x1169cc30
xor esi, esi
cmp dword [esp + 0xc], esi
jne 0x1169cc37
mov dword [0x117dfcc0], 0x57
xor eax, eax
jmp 0x1169ccfd
push ebx
push ebp
push edi
push 0xf003f
push esi
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
mov ebx, str.TSDEncryptDrv
test ebp, ebp
mov edi, 0x117e0e6c
je 0x1169cc83
push 0x10
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1169cc93
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [esp + 0x10], eax
jmp 0x1169ccad
cmp dword [0x117e1700], 0
je 0x1169ccad
push str.CTSDEncryptDrv:_StartService_fail_to_OpenSCManager
jmp 0x1169cca1
cmp dword [0x117e1700], 0
je 0x1169ccad
push str.CTSDEncryptDrv:_StartService_fail_to_OpenService
push ebx
push 4
push edi
call fcn.116deab0
add esp, 0x10
and dword [0x117dfcc0], 0
cmp dword [esp + 0x10], 0
jne 0x1169cce2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x117e1700], 0
mov dword [0x117dfcc0], eax
je 0x1169cce2
push eax
push eax
push str.CTSDEncryptDrv:_StartService_failed__error_ld_0x_08x__n
push ebx
push 4
push edi
call fcn.116deab0
add esp, 0x18
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x1169ccef
push esi
call edi
test ebp, ebp
je 0x1169ccf6
push ebp
call edi
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x116a4e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x116a4eae
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x116a4eae
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x116a4eb3
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x116a4e99
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x116a4ec3
test esi, esi
jne 0x116a4ee1
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x116a4edf
mov byte [eax + esi - 1], 0
jne 0x116a4ee8
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x116aa5d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x116aa620
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x116aa620
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x116aa625
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x116aa60b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x116aa632
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x116b5450
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x116b5491
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x116b5493
mov esi, edi
test esi, esi
je 0x116b5508
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x116b54fd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x116b54fd
cmp dword [esp + 0x1c], eax
jbe 0x116b54ce
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x116b54fd
cmp esi, edi
je 0x116b54ef
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x116b5508
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x116b5520
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x116b5585
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x116b5585
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x116b5585
cmp dword [esp + 0x18], eax
jbe 0x116b556b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x116b5589
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x116b5660
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x116b56bf
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x116b56bf
cmp dword [esp + 0xc], 3
jne 0x116b56bf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x116b56bf
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x116b56bf
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x116b57a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x116b5814
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x116b5814
cmp dword [esp + 0x10], 3
jne 0x116b5814
mov edx, dword [esp + 0x18]
push edx
call fcn.116e0478
mov edi, eax
add esp, 4
test edi, edi
je 0x116b5814
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x116b580b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.116e0410
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x116b5820
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1178f98f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x11794eec]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x116b588b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x116b588d
mov esi, edi
test esi, esi
je 0x116b5957
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x116b594c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x116b58cf
cmp eax, 2
je 0x116b58cf
cmp eax, 6
je 0x116b58cf
cmp eax, 7
jne 0x116b594c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.116e0478
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x116b5932
lea ecx, [esp + 0x14]
call fcn.116a6a10
cmp esi, dword [esp + 0x14]
je 0x116b5927
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.116e0410
add esp, 4
jmp 0x116b5969
call fcn.116e0410
add esp, 4
lea ecx, [esp + 0x10]
push 0x117d3ee4
call fcn.116a6a10
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x116b5957
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x116b5969
push eax
lea ecx, [esp + 0x14]
call fcn.116a6a10
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.116a5d90
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.116a6790
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x116b5f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push 0
call fcn.116ac120
test esi, esi
je 0x116b5fe2
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x116b5fe2
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x116b5f59
cmp eax, 2
je 0x116b5f59
cmp eax, 6
je 0x116b5f59
cmp eax, 7
jne 0x116b5fe2
mov edx, dword [esp + 0x14]
push edi
add edx, 2
push edx
call fcn.116e0478
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push ebx
push 0
push 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop edi
jne 0x116b5fd9
cmp word [ebx], ax
mov esi, ebx
je 0x116b5fc4
mov ecx, dword [esp + 0x18]
push esi
mov edx, dword [ecx + 4]
push edx
call fcn.116ac5d0
push esi
call fcn.116e0997
lea esi, [esi + eax*2 + 2]
add esp, 4
cmp word [esi], 0
jne 0x116b5fa3
push ebx
call fcn.116e0410
add esp, 4
mov eax, 1
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push ebx
call fcn.116e0410
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x116b6650
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x116b6689
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.116e0997
mov ecx, dword [esp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
jne 0x116b6689
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x116b66c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1178fa58
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x116b6716
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x116b6719
mov esi, dword [ebp + 8]
test esi, esi
je 0x116b680c
call fcn.116f3b00
test eax, eax
je 0x116b6769
mov edi, dword [ebp + 0x18]
push edi
call fcn.116e0997
mov ecx, dword [ebp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x116b6800
cmp esi, dword [ebp + 8]
je 0x116b675f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x116b680e
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x116b67a8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.116e1db0
mov edi, esp
test edi, edi
je 0x116b67a8
mov edx, dword [ebp + 0x10]
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x116b67aa
xor edi, edi
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push eax
call fcn.116a0cb0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x116b67f1
cmp esi, dword [ebp + 8]
je 0x116b67db
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.116a1410
mov eax, 1
jmp 0x116b680e
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.116a1410
cmp esi, dword [ebp + 8]
je 0x116b680c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x116b6920
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x116b6963
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0xc]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [esp + 8]
neg eax
sbb eax, eax
not eax
and eax, ecx
mov dword [esp + 8], eax
jmp 0x116b696b
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
push ebp
push esi
test eax, eax
push edi
je 0x116b6a7b
mov esi, dword [esp + 0x20]
xor edi, edi
mov ebp, 2
mov eax, dword [esi + 4]
test eax, eax
jle 0x116b69af
lea ecx, [esp + 0x1c]
push edi
push ecx
mov ecx, esi
call fcn.116b6a90
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
mov eax, dword [edx - 8]
lea ebp, [ebp + eax*2 + 2]
call fcn.116a6790
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jl 0x116b6988
push ebp
call fcn.116e0478
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x1c], edx
je 0x116b6a7b
mov ecx, ebp
push ebx
mov ebx, ecx
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
xor ebx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 4]
mov edi, edx
test eax, eax
jle 0x116b6a21
lea ecx, [esp + 0x24]
push ebx
push ecx
mov ecx, esi
call fcn.116b6a90
mov edx, dword [eax]
push edx
push edi
call fcn.116e0f2f
add esp, 8
lea ecx, [esp + 0x24]
call fcn.116a6790
push edi
call fcn.116e0997
add esp, 4
lea edi, [edi + eax*2 + 2]
mov eax, dword [esi + 4]
inc ebx
cmp ebx, eax
jl 0x116b69e6
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push ebp
push edx
push 7
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop ebx
jne 0x116b6a5f
cmp esi, dword [esp + 0x10]
je 0x116b6a49
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.116e0410
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
ret
mov edx, dword [esp + 0x1c]
push edx
call fcn.116e0410
mov eax, dword [esp + 0x14]
add esp, 4
cmp esi, eax
je 0x116b6a7b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebp
ret