joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5656a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x6f36d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.005d9d70
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.005646a0
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x56570a
mov al, byte [edi + ecx]
test al, al
je 0x56570a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x5656f1
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x56572b
inc eax
sub ecx, 1
jne 0x565720
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x565780
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x565775
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x565774
mov bl, byte [edi + ecx]
test bl, bl
je 0x565774
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x565760
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.005d9d70
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x685e04
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x56583a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x565804
test cl, cl
je 0x565800
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x565804
add eax, 2
add esi, 2
test cl, cl
jne 0x5657e4
xor eax, eax
jmp 0x565809
sbb eax, eax
or eax, 1
test eax, eax
je 0x56583a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x565816
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x565843
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x685e04
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055d6c3
mov esp, ebp
pop ebp
ret
Function at 0x5675b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x567677
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x5675c5
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x568f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65f163
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x6f36d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x6f4790]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00568e20
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x569111
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.005d9d70
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x687e7c
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x569111
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x569005
cmp eax, 2
jne 0x569111
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x569026
test cl, 1
jne 0x569111
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x56902c
jmp 0x569111
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x569111
call fcn.00480300
mov ecx, eax
test ecx, ecx
je 0x56913c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.00567020
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x687e84
push eax
call fcn.004b1540
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.005675b0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x5690f5
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x569096
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.00569190
push dword [0x6f4798]
lea eax, [ebp - 0x74]
push dword [0x6f4794]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x5690d2
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5690ee
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x569113
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x569111
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x56911e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d6c3
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0047dc90
int3
Function at 0x569280
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65f198
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6f36d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x6f4790]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00568e20
test eax, eax
je 0x5693a8
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x569353
cmp dword [esi], 0
je 0x569346
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x569313
mov eax, 1
jmp 0x569374
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x56934c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x569374
cmp dword [esi + 4], 0
jne 0x569353
mov eax, 1
jmp 0x569374
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x56939e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x569386
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x5693ab
xor ebx, ebx
jmp 0x56944f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x56944f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x569408
mov ecx, dword [ebx]
test ecx, ecx
je 0x56946e
push ecx
push eax
call fcn.00616cc9
add esp, 8
test eax, eax
je 0x569408
mov edx, dword [edi]
test edx, edx
je 0x569408
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5693e0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x569413
lea eax, [edx + 0xd]
jmp 0x569448
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x569420
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x687e7c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x56945a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0047dc90
int3
Function at 0x56ac90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x56ad01
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x56accf
cmp eax, 2
jne 0x56aceb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x56acfb
test ecx, ecx
je 0x56acf6
test cl, 1
jne 0x56aceb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x56acfb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x56ef30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6f36d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x56f115
test edi, edi
je 0x56f115
mov ecx, dword [esi + 0x20]
mov eax, 0x532ae21d
sub ecx, dword [esi + 0x1c]
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x56f115
imul eax, ebx, 0x314
mov ebx, dword [esi + 0x1c]
mov ebx, dword [eax + ebx]
test byte [ebx + 0x26], 0x10
jne 0x56f115
mov eax, dword [ebp + 0x10]
cmp dword [ebx + 0x18], eax
ja 0x56f115
mov esi, dword [esi + 0xc]
mov edx, dword [ebx + 0x2a]
movzx eax, word [edx + esi + 0x1c]
movzx ecx, word [edx + esi + 0x1a]
add eax, edx
add ecx, eax
lea eax, [esi + 0x1e]
add eax, ecx
movzx ecx, word [ebx + 0xa]
mov dword [ebp - 8], eax
test cx, cx
jne 0x56f12a
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0xc], ecx
test esi, esi
je 0x56f01d
test eax, eax
je 0x56efe9
cmp ecx, esi
jb 0x56efe9
push esi
push eax
push edi
call fcn.005d9270
add esp, 0xc
jmp 0x56f01d
push ecx
push 0
push edi
call fcn.005d9d70
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x56f008
call fcn.005e4389
mov dword [eax], 0x16
jmp 0x56f018
cmp dword [ebp - 0xc], esi
jae 0x56f01d
call fcn.005e4389
mov dword [eax], 0x22
call fcn.005e3e54
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x56f10e
or eax, 0xffffffff
cmp edx, 8
jb 0x56f0e6
mov esi, edx
shr esi, 3
nop dword [eax]
movzx ecx, byte [edi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
movzx ecx, byte [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
movzx ecx, byte [edi + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
movzx ecx, byte [edi + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
movzx ecx, byte [edi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
movzx ecx, byte [edi + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
movzx ecx, byte [edi + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
movzx ecx, byte [edi + 7]
add edi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
sub esi, 1
jne 0x56f040
test edx, edx
je 0x56f10a
nop word [eax + eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6881c0]
sub edx, 1
jne 0x56f0f0
not eax
jmp 0x56f110
xor eax, eax
cmp eax, dword [ebx + 0x10]
je 0x56f156
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d6c3
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, 8
jne 0x56f115
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push edi
push dword [ebx + 0x14]
push eax
call fcn.00575070
add esp, 0x14
test eax, eax
je 0x56f115
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x10]
jne 0x56f115
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055d6c3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x570cb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x570daf
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x570daf
or eax, 0xffffffff
cmp esi, 8
jb 0x570d87
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
sub edi, 1
jne 0x570ce0
pop edi
test esi, esi
je 0x570daa
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x689a10]
sub esi, 1
jne 0x570d90
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x576db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x576dbf
pop ebp
jmp fcn.005783b0
xor eax, eax
pop ebp
ret 0xc
Function at 0x5786b0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65fb03
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x6f36d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x578755
cmp word [esi], di
je 0x578755
test eax, eax
je 0x578711
cmp word [eax], di
je 0x578711
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x578755
jmp 0x578750
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.005d9d70
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x578755
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x5787cc
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x5787b7
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x578785
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x5787a6
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x5787ec
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x5787b7
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x5787cc
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d6c3
mov esp, ebp
pop ebp
ret 0x30
call fcn.00507fe2
int3

Function at 0x579790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x5797a5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5797b0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x5d5240
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66c1bf
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6f36d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00480300
mov ecx, eax
test ecx, ecx
je 0x5d53f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00480300
mov ecx, eax
test ecx, ecx
je 0x5d53fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00480300
mov ecx, eax
test ecx, ecx
je 0x5d5408
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov dword [esi + 0x10], eax
test edx, edx
jne 0x5d5318
xor ecx, ecx
jmp 0x5d5330
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d5320
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00482800
push edi
mov ecx, ebx
call fcn.0047d7e0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x5d534c
xor ecx, ecx
jmp 0x5d5364
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d5354
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00482800
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.005d6230
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.0047d7e0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5d53a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x5d53de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x5d53de
cmp dword [esi + 0x10], 0
je 0x5d53d5
push dword [edi]
call fcn.00622f2c
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.0047dc90
push 0x80004005
call fcn.0047dc90
push 0x80004005
call fcn.0047dc90
int3
Function at 0x5d60b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66c318
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6f36d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x5d6211
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.__set_log_lev0
push edi
call ebx
test eax, eax
je 0x5d6108
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 4]
jmp 0x5d6211
push str.__set_log_lev1
push edi
call ebx
test eax, eax
je 0x5d6122
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
jmp 0x5d6211
push str.__set_log_lev2
push edi
call ebx
test eax, eax
je 0x5d613c
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 4]
jmp 0x5d6211
push str.__set_log_lev3
push edi
call ebx
test eax, eax
je 0x5d6156
mov eax, dword [esi]
mov ecx, esi
push 3
call dword [eax + 4]
jmp 0x5d6211
push str.__reload_log_switch
push edi
call ebx
test eax, eax
je 0x5d6211
push 3
mov ecx, esi
call fcn.005d6050
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.004b2ac0
push 0x673a9c
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.005d7d50
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d61ae
push 0
mov ecx, esi
call fcn.005d6050
lea eax, [esi + 0x2c]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x5d61bf
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x44], 0
mov byte [ebp - 4], 1
je 0x5d6201
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x5d6201
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 4]
call eax
test al, al
je 0x5d6201
push str._______log_reload_switch
lea ecx, [ebp - 0x44]
call fcn.0048e8e0
mov ecx, dword [esi + 0x44]
lea edx, [ebp - 0x44]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x44]
call fcn.0047d710
lea ecx, [ebp - 0x2c]
call fcn.00534a60
lea ecx, [ebp - 0x28]
call fcn.0047d710
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d6c3
mov esp, ebp
pop ebp
ret 4