joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415030
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
push edi
push 0x1b
mov byte [esp + 0xe], 0x42
mov byte [esp + 0xf], 0x4b
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x11], 0x4f
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x435918]
movsx eax, ax
test eax, ecx
je 0x41506c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x43a174]
je 0x415075
cmp dword [0x43a1b0], 5
jne 0x4150bb
push 5
push 0x43a1b0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0xa]
and esi, 0xff
push 2
push ecx
push esi
call dword [0x44d8e0]
lea edx, [esi*8]
add esp, 0xc
sub edx, esi
pop edi
lea ecx, [esi + edx*4]
pop esi
mov dword [ecx*4 + 0x44cd08], eax
mov eax, 1
add esp, 8
ret
mov esi, dword [esp + 0x14]
lea edx, [esp + 0xc]
and esi, 0xff
push 2
push edx
push esi
call dword [0x44d8e0]
lea ecx, [esi*8]
add esp, 0xc
sub ecx, esi
lea edi, [esi + ecx*4]
shl edi, 2
cmp eax, 1
mov dword [edi + 0x44cd08], eax
je 0x4150fb
pop edi
mov eax, 1
pop esi
add esp, 8
ret
lea edx, [esp + 0xe]
push 2
push edx
push esi
call dword [0x44d484]
add esp, 0xc
cmp eax, 1
mov dword [edi + 0x44cd08], eax
je 0x415122
pop edi
mov eax, 1
pop esi
add esp, 8
ret
mov al, byte [esp + 0xe]
mov byte [edi + 0x44cd53], al
pop edi
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x4151f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0x1b
mov byte [esp + 0x16], 0x42
mov byte [esp + 0x17], 0x4b
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x15], 0x4f
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x4152ff
cmp dword [0x43a1b0], 5
je 0x4152ff
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x10]
and esi, 0xff
push 2
push eax
push esi
call dword [0x44d8e0]
lea ecx, [esi*8]
add esp, 0xc
sub ecx, esi
lea edi, [esi + ecx*4]
shl edi, 2
cmp eax, 1
mov dword [edi + 0x44cd08], eax
jne 0x41533a
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x415278
mov dx, word [0x44ccc0]
mov word [esp + 0x16], dx
jmp 0x415283
mov ax, word [0x44d8c0]
mov word [esp + 0x16], ax
mov ebp, dword [esp + 0x2c]
test ebp, ebp
jne 0x415297
mov ebx, 2
mov word [esp + 0x14], bp
jmp 0x4152a3
mov ebx, 4
mov word [esp + 0x14], 1
lea ecx, [esp + 0x14]
push 4
push ecx
push esi
call dword [0x44d8e0]
add esp, 0xc
cmp eax, 1
mov dword [edi + 0x44cd08], eax
jne 0x41533a
lea edx, [esp + 0x18]
push ebx
push edx
push esi
call dword [0x44d484]
add esp, 0xc
cmp eax, 1
mov dword [edi + 0x44cd08], eax
jne 0x41533a
mov al, byte [esp + 0x18]
cmp ebp, 1
mov byte [edi + 0x44cd53], al
jne 0x4152f5
mov cx, word [esp + 0x1a]
mov word [edi + 0x44cd66], cx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
push 5
push 0x43a1b0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x12]
and esi, 0xff
push 2
push edx
push esi
call dword [0x44d8e0]
lea ecx, [esi*8]
add esp, 0xc
sub ecx, esi
lea edx, [esi + ecx*4]
mov dword [edx*4 + 0x44cd08], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x417850
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push esi
push edi
push 0x1b
mov byte [esp + 0xc], 0x42
mov byte [esp + 0xd], 0x4b
mov byte [esp + 0xe], 0x47
mov byte [esp + 0xf], 0x4f
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x417884
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x43a174]
je 0x41788d
cmp dword [0x43a1b0], 5
jne 0x4178d3
push 5
push 0x43a1b0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, dword [esp + 0x18]
lea eax, [esp + 8]
and esi, 0xff
push 2
push eax
push esi
call dword [0x44d8e0]
lea ecx, [esi*8]
add esp, 0xc
sub ecx, esi
pop edi
lea edx, [esi + ecx*4]
pop esi
mov dword [edx*4 + 0x44cd08], eax
mov eax, 1
add esp, 0xc
ret
mov esi, dword [esp + 0x18]
lea eax, [esp + 0xa]
and esi, 0xff
push 2
push eax
push esi
call dword [0x44d8e0]
lea ecx, [esi*8]
add esp, 0xc
sub ecx, esi
lea edi, [esi + ecx*4]
shl edi, 2
cmp eax, 1
mov dword [edi + 0x44cd08], eax
je 0x417913
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
lea edx, [esp + 0xc]
push 6
push edx
push esi
call dword [0x44d484]
add esp, 0xc
cmp eax, 1
mov dword [edi + 0x44cd08], eax
je 0x41793a
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
mov al, byte [esp + 0xc]
mov cx, word [esp + 0xe]
mov dx, word [esp + 0x10]
mov byte [edi + 0x44cd53], al
mov word [edi + 0x44cd66], cx
mov word [edi + 0x44cd68], dx
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x41a5e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x44d864]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push str.Loading_BINARY_File
push ebp
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [esp + 0x28]
mov eax, dword [0x4376e8]
mov dword [0x443dbc], ebp
mov edx, dword [0x44ccf4]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
push 0x43b2a0
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x41a708
xor esi, esi
xor ebx, ebx
test eax, eax
mov dword [esp + 0x28], ebx
jle 0x41a69c
mov edx, edi
mov ecx, 0x43b2a0
sub edx, ebp
mov eax, ebp
mov dword [esp + 0x14], edx
sub ecx, ebp
jmp 0x41a658
mov edx, dword [esp + 0x14]
add edx, eax
cmp edx, dword [0x44d49c]
jae 0x41a6e1
cmp eax, dword [esp + 0x20]
jb 0x41a68e
cmp eax, dword [esp + 0x24]
ja 0x41a68e
mov edx, dword [0x44ccb4]
mov bl, byte [ecx + eax]
add edx, esi
inc esi
mov byte [edx + edi], bl
mov edx, dword [0x443dbc]
mov ebx, dword [esp + 0x28]
inc edx
mov dword [0x443dbc], edx
mov edx, dword [esp + 0x10]
inc ebx
inc eax
cmp ebx, edx
mov dword [esp + 0x28], ebx
jl 0x41a654
mov eax, dword [0x44d894]
mov ecx, dword [0x443dbc]
add ecx, eax
add ebp, ebx
mov dword [0x443dbc], ecx
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [0x44d478], ebp
call fcn.00421660
mov eax, dword [0x44d49c]
add edi, esi
add esp, 4
cmp edi, eax
ja 0x41a6f6
mov eax, dword [0x4376e8]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jl 0x41a708
jmp 0x41a60f
mov edx, dword [esp + 0x1c]
add ebx, ebp
push edx
mov dword [0x44d478], ebx
call fcn.00421660
add esp, 4
pop edi
mov eax, 1
pop esi
pop ebp
mov dword [0x43a300], eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x41bbc0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x439994]
sub esp, 0x204
push ebx
push ebp
mov ebp, 1
push esi
cmp eax, ebp
push edi
jne 0x41bc0b
push ebp
call fcn.00424180
add esp, 4
test eax, eax
jne 0x41bc0b
call fcn.00424330
push 0x30
push 0x432594
push str.Error_Identification_on_hardware__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x204
ret
mov eax, dword [esp + 0x21c]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x44ccf4], eax
jne 0x41bc66
cmp dword [0x439994], ebp
jne 0x41bc42
call fcn.00424330
mov ecx, dword [esp + 0x218]
push 0x10
push 0
push str.Error_filename_specified.
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x204
ret
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
mov dword [0x44c0f8], eax
call esi
mov edx, dword [0x44d864]
push str.Saving_buffer_to_file_now_
push 0
push 0x401
push edx
mov dword [0x44d530], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x224]
mov edi, dword [esp + 0x220]
mov ebx, dword [esp + 0x218]
sub eax, edi
inc eax
push ebx
mov dword [0x44d520], eax
mov dword [0x44d478], 0
call fcn.00421660
mov ecx, dword [0x44d51c]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [0x44ccb4], eax
jne 0x41bd14
cmp dword [0x439994], ebp
jne 0x41bcf2
call fcn.00424330
mov edx, dword [0x44ccf4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x44d530]
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x204
ret
push ebx
call fcn.00421a90
add esp, 4
mov ebp, 0x200
mov eax, dword [0x44ccb4]
xor esi, esi
cmp edi, dword [esp + 0x224]
ja 0x41bd43
mov cl, byte [eax + edi]
inc edi
mov byte [esp + esi + 0x14], cl
inc esi
cmp esi, 0x200
jl 0x41bd29
mov ecx, dword [0x44ccf4]
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, 0x200
jl 0x41bd7c
mov dword [0x44d478], ebp
push ebx
add ebp, 0x200
call fcn.00421660
add esp, 4
jmp 0x41bd22
cmp dword [0x439994], 1
jne 0x41bd8a
call fcn.00424330
mov edx, dword [0x44ccf4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x44d51c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [0x44d520]
push ebx
mov dword [0x44d478], ecx
call fcn.00421660
add esp, 4
call fcn.00421740
mov edx, dword [0x44d530]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x204
ret
Function at 0x421900
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x439ebc]
push esi
test eax, eax
je 0x4219a1
cmp dword [0x44d524], 1
jne 0x421966
push 0x44c160
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42193a
push 0x20003
push 0
push 0x44c160
call dword [sym.imp.WINMM.dll_PlaySoundA]
pop esi
ret
mov esi, dword [sym.imp.USER32.dll_MessageBeep]
push 0xffffffffffffffff
call esi
push 0x50
call fcn.00424140
add esp, 4
push 0xffffffffffffffff
call esi
push 0x50
call fcn.00424140
add esp, 4
push 0xffffffffffffffff
call esi
push 0x10
call esi
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
push 0x96
push 0x2ff
call esi
push 0x1e
call fcn.00424140
add esp, 4
push 0x96
push 0x2ff
call esi
push 0x1e
call fcn.00424140
add esp, 4
push 0x64
push 0x2ff
call esi
pop esi
ret
Function at 0x421da0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x14
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push MenuHelp
push 0x42e350
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x44ccf4], eax
jne 0x421dd1
xor eax, eax
pop esi
add esp, 0x14
ret
lea ecx, [esp + 4]
push esi
push ecx
lea edx, [esp + 0x10]
push 0x10
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x44ccf4]
push esi
push eax
mov dword [0x44bf84], esi
mov dword [0x44bf80], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
dec eax
mov dword [0x43a684], eax
mov al, byte [esp + esi + 8]
cmp al, 0x20
je 0x421e14
cmp al, 0xa
je 0x421e14
cmp al, 0xd
jne 0x421e17
inc esi
jmp 0x421e04
mov edx, dword [esp + 4]
cmp esi, edx
jb 0x421e33
mov ecx, dword [0x44ccf4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x14
ret
mov cl, byte [esp + esi + 8]
cmp cl, 0x3a
jne 0x421e7a
mov al, byte [esp + esi + 9]
cmp al, 0x30
jl 0x421e7a
cmp al, 0x39
jg 0x421e7a
mov edx, dword [esp + 0x1c]
mov dword [0x44bf84], 1
push edx
call fcn.00421f60
add esp, 4
mov dword [0x44bf80], eax
mov eax, dword [0x44ccf4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x14
ret
cmp cl, 0x53
je 0x421e84
cmp cl, 0x73
jne 0x421eb9
mov al, byte [esp + esi + 9]
cmp al, 0x30
jl 0x421e90
cmp al, 0x33
jle 0x421e98
cmp al, 0x37
jl 0x421eb9
cmp al, 0x39
jg 0x421eb9
mov ecx, dword [esp + 0x1c]
mov dword [0x44bf84], 2
push ecx
call fcn.00422120
add esp, 4
mov dword [0x44bf80], eax
jmp 0x421f3f
cmp cl, 1
je 0x421ec3
cmp cl, 2
jne 0x421f04
cmp byte [esp + esi + 0xb], 0x24
jne 0x421f04
cmp byte [esp + esi + 0xc], 0x41
jne 0x421f04
mov eax, dword [esp + 0x1c]
mov dword [0x44bf84], 3
push eax
call fcn.004222b0
mov ecx, dword [0x44ccf4]
add esp, 4
mov dword [0x44bf80], eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x14
ret
mov al, byte [esp + esi + 8]
cmp al, 0x20
je 0x421f2c
cmp al, 0xa
je 0x421f2c
cmp al, 0xd
je 0x421f2c
cmp al, 0x30
jl 0x421f1c
cmp al, 0x39
jle 0x421f2c
cmp al, 0x41
jl 0x421f24
cmp al, 0x46
jle 0x421f2c
cmp al, 0x61
jl 0x421f31
cmp al, 0x66
jg 0x421f31
inc esi
cmp esi, edx
jb 0x421f04
cmp esi, edx
jne 0x421f3f
mov dword [0x44bf84], 8
mov edx, dword [0x44ccf4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x422ce0
Capabilities:
Get file size

Disassembly:
sub esp, 0x200
mov ax, word [0x43a310]
push esi
mov esi, dword [esp + 0x210]
push edi
mov word [esp + 8], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
test esi, esi
stosw word es:[edi], ax
je 0x422dc4
lea ecx, [esp + 8]
push 0x439894
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
push str.XCY8C3X.EXE
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0x80
lea eax, [esp + eax + 0x10]
push 3
push 0
push 0
lea ecx, [esp + 0x1c]
mov byte [eax - 3], 0x63
push MenuHelp
mov byte [eax - 2], 0x66
push ecx
mov byte [eax - 1], 0x67
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x44ccf4], eax
jne 0x422da8
push str.Fail_to_Load_Programmer_Status.
push 0x44d540
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x214]
add esp, 8
push 0x10
push 0
push 0x44d540
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x200
ret
mov eax, dword [esp + 0x20c]
push esi
push 0
push eax
call fcn.00422e70
add esp, 0xc
pop edi
pop esi
add esp, 0x200
ret
push 0x44d4f0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [0x44d4fc]
mov eax, dword [0x44d4f8]
xor edx, edx
and ecx, 0xffff
mov dx, word [0x44d4fa]
push ecx
and eax, 0xffff
push edx
push eax
push str.__02d:_02d:_02d__tRun_Load_Job_Function___r_n
push 0x44d540
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
call fcn.0040ac50
mov ecx, dword [0x44ccf4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xafc
jbe 0x422e42
mov edx, dword [esp + 0x210]
mov eax, dword [esp + 0x20c]
push 0
push edx
push eax
call fcn.00422e70
add esp, 0xc
pop edi
pop esi
add esp, 0x200
ret
mov ecx, dword [esp + 0x210]
mov edx, dword [esp + 0x20c]
push ecx
push edx
call fcn.00423610
add esp, 8
pop edi
pop esi
add esp, 0x200
ret
Function at 0x424140
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
mov edi, dword [esp + 0x10]
mov esi, eax
call ebx
cmp eax, esi
jb 0x424167
mov ecx, edi
sub eax, esi
and ecx, 0xffff
cmp eax, ecx
jae 0x424178
jmp 0x424151
mov edx, edi
sub eax, esi
and edx, 0xffff
dec eax
add edx, esi
cmp eax, edx
jb 0x424151
pop edi
pop esi
pop ebx
ret

Function at 0x427626
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x438bd0
cmp edx, dword [eax]
je 0x427648
add eax, 8
inc ecx
cmp eax, 0x438c60
jl 0x427639
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x438bd0]
jne 0x427776
mov eax, dword [0x43a324]
cmp eax, 1
je 0x427750
test eax, eax
jne 0x427679
cmp dword [0x43879c], 1
je 0x427750
cmp edx, 0xfc
je 0x427776
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4276b0
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00427f90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00426380
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4276f3
lea eax, [ebp - 0x1a4]
push eax
call fcn.00426380
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42cb2c
push edi
call fcn.00428e90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00427f90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00427fa0
lea eax, [ebp - 0xa0]
push 0x42cb0c
push eax
call fcn.00427fa0
push dword [esi + 0x438bd4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00427fa0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0042a01f
add esp, 0x2c
pop edi
jmp 0x427776
lea eax, [ebp + 8]
lea esi, [esi + 0x438bd4]
push 0
push eax
push dword [esi]
call fcn.00426380
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5fee1320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x5fee133b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x5fee1372
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x5fee136e
jmp 0x5fee1360
cmp esi, eax
jae 0x5fee1372
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x5fee1360
cmp esi, eax
jb 0x5fee1379
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5feef291
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.5feedad0
lea ecx, [ebp - 0x54]
call fcn.5feff466
push str.SeDebugPrivilege
lea ecx, [ebp - 0x54]
call fcn.5feffa1b
mov esi, 0x5ff4320c
test al, al
jne 0x5feef2ee
mov eax, dword [0x5ff4320c]
cmp eax, esi
je 0x5feef2f3
test byte [eax + 0x1c], 1
je 0x5feef2f3
cmp byte [eax + 0x19], 2
jb 0x5feef2f3
push 0x5ff35fbc
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
mov eax, dword [0x5ff4320c]
mov ecx, dword [edi + 0xb0]
xor edx, edx
sub ecx, edx
mov dword [ebp + 0xc], 1
je 0x5feef3b8
dec ecx
je 0x5feef378
dec ecx
je 0x5feef338
cmp eax, esi
je 0x5feef47d
test byte [eax + 0x1c], 1
je 0x5feef47d
cmp byte [eax + 0x19], 2
jb 0x5feef47d
push 0x5ff35fbc
push 0x1b
jmp 0x5feef46f
push ebx
push dword [ebp + 8]
mov ecx, edi
call fcn.5feee469
test eax, eax
jne 0x5feef4a8
mov eax, dword [0x5ff4320c]
cmp eax, esi
je 0x5feef47d
test byte [eax + 0x1c], 1
je 0x5feef47d
cmp byte [eax + 0x19], 2
jb 0x5feef47d
push 0x5ff35fbc
push 0x1a
jmp 0x5feef46f
push ebx
push dword [ebp + 8]
mov ecx, edi
call fcn.5feef208
test eax, eax
jne 0x5feef4a8
mov eax, dword [0x5ff4320c]
cmp eax, esi
je 0x5feef47d
test byte [eax + 0x1c], 1
je 0x5feef47d
cmp byte [eax + 0x19], 2
jb 0x5feef47d
push 0x5ff35fbc
push 0x19
jmp 0x5feef46f
cmp dword [edi + 0x70], edx
je 0x5feef43c
push ebx
push dword [ebp + 8]
mov ecx, edi
call fcn.5feee469
test eax, eax
jne 0x5feef4a8
mov eax, dword [0x5ff4320c]
cmp eax, esi
je 0x5feef3fa
test byte [eax + 0x1c], 1
je 0x5feef3fa
cmp byte [eax + 0x19], 2
jb 0x5feef3fa
push 0x5ff35fbc
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
mov eax, dword [ebx + 0xc]
and dword [ebp + 0xc], 0
cmp dword [eax - 0xc], 0
jne 0x5feef4a8
push ebx
push dword [ebp + 8]
mov ecx, edi
call fcn.5feef208
test eax, eax
jne 0x5feef4a8
mov eax, dword [0x5ff4320c]
cmp eax, esi
je 0x5feef47d
test byte [eax + 0x1c], 1
je 0x5feef47d
cmp byte [eax + 0x19], 2
jb 0x5feef47d
push 0x5ff35fbc
push 0x16
jmp 0x5feef46f
cmp dword [edi + 0xac], edx
je 0x5feef483
push ebx
push dword [ebp + 8]
mov ecx, edi
call fcn.5feef208
test eax, eax
jne 0x5feef4a8
mov eax, dword [0x5ff4320c]
cmp eax, esi
je 0x5feef47d
test byte [eax + 0x1c], 1
je 0x5feef47d
cmp byte [eax + 0x19], 2
jb 0x5feef47d
push 0x5ff35fbc
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
and dword [ebp + 0xc], 0
jmp 0x5feef4a8
cmp eax, esi
je 0x5feef4a8
test byte [eax + 0x1c], 1
je 0x5feef4a8
cmp byte [eax + 0x19], 2
jb 0x5feef4a8
push 0x5ff35fbc
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
lea ecx, [ebp - 0x54]
call fcn.5feff630
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5fef0a3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov edi, ecx
cmp ebx, eax
je 0x5fef0a8c
cmp dword [esi], eax
jne 0x5fef0a8c
mov eax, dword [0x5ff4320c]
cmp eax, 0x5ff4320c
je 0x5fef0a80
test byte [eax + 0x1c], 1
je 0x5fef0a80
cmp byte [eax + 0x19], 2
jb 0x5fef0a80
push 0x5ff36058
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
mov dword [edi + 8], 0x57
jmp 0x5fef0b26
push esi
push ebx
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 8], eax
test eax, eax
jne 0x5fef0b26
inc eax
cmp dword [ebp + 0xc], eax
je 0x5fef0add
cmp dword [ebp + 0xc], 2
je 0x5fef0add
cmp dword [ebp + 0xc], 7
je 0x5fef0add
mov ecx, dword [0x5ff4320c]
cmp ecx, 0x5ff4320c
je 0x5fef0b1f
test byte [ecx + 0x1c], al
je 0x5fef0b1f
cmp byte [ecx + 0x19], 2
jb 0x5fef0b1f
push 0x5ff36058
push 0x17
jmp 0x5fef0b11
mov ecx, dword [esi]
test al, cl
jne 0x5fef0af1
test ebx, ebx
je 0x5fef0b28
shr ecx, 1
cmp word [ebx + ecx*2 - 2], 0
je 0x5fef0b28
mov ecx, dword [0x5ff4320c]
cmp ecx, 0x5ff4320c
je 0x5fef0b1f
test byte [ecx + 0x1c], al
je 0x5fef0b1f
cmp byte [ecx + 0x19], 2
jb 0x5fef0b1f
push 0x5ff36058
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fee1540
add esp, 0x10
mov dword [edi + 8], 0xd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x5fef0b2f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
cmp edi, 1
je 0x5fef0b79
cmp edi, 2
je 0x5fef0b79
cmp edi, 7
je 0x5fef0b79
mov eax, dword [0x5ff4320c]
cmp eax, 0x5ff4320c
je 0x5fef0b75
test byte [eax + 0x1c], 1
je 0x5fef0b75
cmp byte [eax + 0x19], 2
jb 0x5fef0b75
push 0x5ff36058
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
xor eax, eax
jmp 0x5fef0ba5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push edi
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], eax
mov eax, ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x5fef0bab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov esi, ecx
push dword [esi + 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 8], eax
test eax, eax
je 0x5fef0be2
xor eax, eax
jmp 0x5fef0c21
cmp dword [ebp - 4], 4
je 0x5fef0c1e
mov eax, dword [0x5ff4320c]
cmp eax, 0x5ff4320c
je 0x5fef0c15
test byte [eax + 0x1c], 1
je 0x5fef0c15
cmp byte [eax + 0x19], 2
jb 0x5fef0c15
push 0x5ff36058
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x5fef0bde
xor eax, eax
inc eax
pop esi
leave
ret 8