joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ccf4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040aff0
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410e2c
mov edi, eax
cmp edi, 0x104
jbe 0x42cc9f
mov eax, edi
add eax, eax
call fcn.00406e3c
mov esi, eax
jmp 0x42cca1
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410e2c
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42ccda
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42ccc4
mov eax, esp
cmp esi, eax
je 0x42cce7
mov eax, esi
call fcn.00406e58
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42cd20
cmp bl, 0
je 0x42cd1c
cmp bl, 0x41
jl 0x42cd17
cmp bl, 0x5a
jg 0x42cd17
or bl, 0x20
xor al, bl
inc esi
jmp 0x42ccfb
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42cc60

Function at 0x42d63c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040b674
add esp, 0x800
pop ebx
ret

Function at 0x42dc38
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.0040ab08
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040b5c0
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x42dc7d
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040aca0
jmp 0x42dc96
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040b74c
push ebx
mov eax, dword [esi]
call fcn.0040b5c0
push eax
push ebp
call sub.KERNEL32.DLL_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42ff04
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42ff22
mov eax, dword [eax - 4]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42ff3a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42ff35
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
jmp 0x42ff3f
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42ffad
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42fff6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42ff6b
inc dword [ebp - 0xc]
jmp 0x42ff83
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42ff83
cmp dword [ebp - 0xc], 0
jle 0x42ff83
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42ffa5
xor eax, eax
jmp 0x42ffa1
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42ffa0
mov eax, esi
jmp 0x42fff9
inc eax
cmp eax, ecx
jle 0x42ff8d
inc esi
cmp esi, dword [ebp - 8]
jl 0x42ff57
jmp 0x42fff6
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42fff6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42ffce
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42fff0
xor eax, eax
jmp 0x42ffec
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42ffeb
mov eax, esi
jmp 0x42fff9
inc eax
cmp eax, ecx
jle 0x42ffd8
inc esi
cmp esi, dword [ebp - 8]
jl 0x42ffb6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x430214
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x430231
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x43023f
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x430361
test ebx, ebx
jl 0x430361
test esi, esi
jle 0x430361
mov eax, dword [ebp - 8]
call fcn.0040b5c0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b5c0
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x4302fe
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x430361
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x4302e3
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x4302b2
inc dword [ebp - 0x14]
jmp 0x4302c2
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x4302c2
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x4302cd
or eax, 0xffffffff
jmp 0x4302e3
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x4302e0
inc eax
jmp 0x4302e3
or eax, 0xffffffff
test eax, eax
jl 0x4302eb
cmp esi, eax
jg 0x4302a0
cmp esi, eax
jg 0x4302f6
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x430364
inc edx
dec dword [ebp - 0x1c]
jne 0x43029c
jmp 0x430361
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x430361
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x430348
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x430327
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x430332
or eax, 0xffffffff
jmp 0x430348
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x430345
inc eax
jmp 0x430348
or eax, 0xffffffff
test eax, eax
jl 0x430350
cmp esi, eax
jg 0x430310
cmp esi, eax
jg 0x43035b
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x430364
inc edx
dec dword [ebp - 0x1c]
jne 0x43030c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4406e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4406e8
mov eax, edx
pop esi
pop ebx
ret

Function at 0x44335c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x443373
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x443363
mov eax, ecx
pop ebx
ret
Function at 0x457830
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x457844
add esp, 0xfffffff0
call fcn.00409320
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x4517b4]
call fcn.00475f54
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x456800]
call fcn.00478d08
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x456800]
call fcn.00478d08
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x457899
call fcn.00409378
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c22b4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c2302
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004c1798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c231b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c2324
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004c1798
dec esi
jne 0x4c2346
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x50a958
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x50ab17
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040af40
mov eax, dword [ebp - 4]
call fcn.0050a238
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x50a9aa
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b9e0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0050b8dc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x50aa8b
xor eax, eax
push ebp
push 0x50aa84
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0050a544
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0050ab4c
test al, al
je 0x50aa60
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040aca0
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x50aa60
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b5c0
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050a4a4
test al, al
je 0x50aa5a
mov eax, dword [ebp - 8]
call fcn.0040b5c0
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040b620
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0050a958
dec ebx
cmp ebx, 0xffffffff
jne 0x50aa09
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50aa8b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0050a544
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x58e9c8], 0
je 0x50aacb
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5c0
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0050a530
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050a4a4
mov ebx, eax
jmp 0x50aaf2
mov eax, dword [ebp - 4]
call fcn.0040b5c0
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0050a530
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0050a4a4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ab1e
lea eax, [ebp - 0x3c]
call fcn.0040ab08
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ab68
pop eax
jmp eax
Function at 0x50abbc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x50ac76
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0050ab4c
test al, al
je 0x50ac56
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040aca0
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x50ac56
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5c0
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040b5c0
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040b620
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x50ac0f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ac7d
lea eax, [ebp - 0x2c]
call fcn.0040ab08
lea eax, [ebp - 4]
call fcn.0040ab08
pop eax
jmp eax

Function at 0x50b7b8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0050a250
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040b5c0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.0050a4a4
test al, al
jne 0x50b820
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x587a34]
mov dl, 1
mov eax, dword [0x508e60]
call fcn.0042a6ac
call fcn.0040a1f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x50b82c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b5c0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.0050a4a4
test al, al
jne 0x50b88d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x587fa8]
mov dl, 1
mov eax, dword [0x508e60]
call fcn.0042a6ac
call fcn.0040a1f0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0050a2b8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50bea4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x50bfd0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.0050a544
xor eax, eax
push ebp
push 0x50bfa9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050ab4c
test al, al
je 0x50bf8b
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0050bd7c
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040aca0
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x50bf8b
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5c0
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050a4a4
test al, al
je 0x50bf87
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5c0
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040b620
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0050bd7c
pop ecx
inc edi
dec ebx
jne 0x50bf2f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bfb0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.0050a544
pop eax
jmp eax
Function at 0x50bfe0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50c238
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0050a544
xor eax, eax
push ebp
push 0x50c20c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050ab4c
test al, al
je 0x50c1ee
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040aca0
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x50c1ee
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5c0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050a4a4
test al, al
je 0x50c1e2
mov eax, dword [ebp - 4]
call fcn.0040b5c0
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040b620
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050b8dc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50c1e2
xor eax, eax
push ebp
push 0x50c1db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0050a544
xor eax, eax
push ebp
push 0x50c1bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b5c0
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040b620
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050a548
mov eax, dword [ebp - 4]
call fcn.0040b5c0
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040b620
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050b8dc
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x50c196
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050bea4
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0050bfe0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c19d
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x50c06b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c213
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0050a544
pop eax
jmp eax
Function at 0x51a80c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040ab08
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x51a83d
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040aca0
add esp, 0x24
pop ebx
ret

Function at 0x544608
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x544610
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5447bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x5447d8
call fcn.0040b828
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.005421d8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x5447ec
call fcn.004e7914
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x544689
mov eax, dword [eax - 4]
test eax, eax
jle 0x5446ca
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.005421d8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x544854
call fcn.004e7914
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b7d0
mov eax, esi
mov edx, 0x544880
call fcn.0040b7d0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5446e0
mov eax, dword [eax - 4]
test eax, eax
jle 0x54474c
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x544894
call fcn.004e7914
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b7d0
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x544715
mov eax, dword [eax - 4]
test eax, eax
jle 0x544740
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x5448c4
call fcn.004e7914
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b7d0
mov eax, esi
mov edx, 0x544880
call fcn.0040b7d0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x544756
mov eax, dword [eax - 4]
test eax, eax
jle 0x544781
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x5448f0
call fcn.004e7914
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b7d0
mov eax, esi
mov edx, 0x544880
call fcn.0040b7d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5447c6
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040ab68
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040ab68
lea eax, [ebp - 4]
call fcn.0040ab08
pop eax
jmp eax