joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523780
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x410], 0
push 0x3ff
push 0
lea eax, [ebp - 0x40f]
push eax
call fcn.004720b0
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x818], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x817]
push ecx
call fcn.004720b0
add esp, 0xc
mov dword [ebp - 0x414], 0x400
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x58]
push eax
push 0x5e9438
lea ecx, [ebp - 0x410]
push ecx
call fcn.00471bce
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
push 0x20007
push 0
push 0x5e9444
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x52388c
mov eax, dword [ebp + 8]
cmp dword [eax + 0x80], 0
je 0x523847
xor ecx, ecx
je 0x523847
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x80]
mov dword [ebp - 0x81c], eax
jmp 0x523851
mov dword [ebp - 0x81c], 0xffffff86
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x81c]
mov dword [ecx + 0x80], edx
push 0
push 0xff
push 0
push 0
push 0x267
push 0xffffffffffffff86
mov eax, dword [ebp + 8]
push eax
call fcn.0052cd20
add esp, 0x1c
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x80]
jmp 0x523984
mov edx, dword [ebp - 8]
mov dword [ebp - 0x820], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x818]
push ecx
mov edx, dword [ebp - 0x820]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
test eax, eax
jne 0x523978
mov edx, dword [ebp - 0x414]
mov byte [ebp + edx - 0x818], 0
push 0x2d
lea eax, [ebp - 0x818]
push eax
call fcn.0047a800
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x523969
lea ecx, [ebp - 0x410]
push ecx
call fcn.00471d80
add esp, 4
push eax
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x818]
push eax
call fcn.00475d0b
add esp, 0xc
test eax, eax
jne 0x523969
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
mov edx, dword [ebp - 4]
add edx, 1
push edx
call fcn.004781f0
add esp, 8
test eax, eax
jne 0x523969
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x5e946c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005239a0
add esp, 8
mov dword [ebp - 0x414], 0x400
jmp 0x52388c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret
Function at 0x5343c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x228], 0
push 0x103
push 0
lea eax, [ebp - 0x227]
push eax
call fcn.004720b0
add esp, 0xc
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea ecx, [ebp - 0x11f]
push ecx
call fcn.004720b0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x534434
jmp 0x5344cf
mov edx, dword [ebp + 8]
push edx
push str._s_EventLoggingMode
lea eax, [ebp - 0x228]
push eax
call fcn.00471bce
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.SOFTWAREFNPlmLicense_Server
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x53448a
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push str.SOFTWAREMacrovision_CorporationFLEXlm_License_Manager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5344cf
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5344cf
push str.ENABLE
lea edx, [ebp - 0x120]
push edx
call fcn.00476dbc
add esp, 8
test eax, eax
jne 0x5344cf
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], 0
je 0x5344e6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret
Function at 0x534550
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x11c], 0xffffff77
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.004720b0
add esp, 0xc
cmp dword [0x60e91c], 0
je 0x5345b6
movzx ecx, word [ebp + 0x18]
test ecx, ecx
je 0x5345bb
cmp dword [ebp + 0x1c], 0
jne 0x5345bb
jmp 0x5346a7
mov dx, word [ebp + 0x18]
add dx, 1
mov word [ebp + 0x18], dx
movzx eax, word [ebp + 0x18]
shl eax, 2
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00536190
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x53469d
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0x5edf74
lea edx, [ebp - 0x118]
push edx
call fcn.00471bce
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x118]
mov dword [eax], ecx
mov dword [ebp - 8], 1
jmp 0x53461f
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
movzx eax, word [ebp + 0x18]
cmp dword [ebp - 8], eax
jge 0x534660
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + edx*4 - 4]
push ecx
call fcn.0058a340
add esp, 8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp dword [eax + edx*4], 0
jne 0x53465e
mov cx, word [ebp - 8]
mov word [ebp + 0x18], cx
jmp 0x5346a7
jmp 0x534616
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov dx, word [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov cx, word [ebp + 0x10]
push ecx
mov dx, word [ebp + 0xc]
push edx
mov eax, dword [0x60e91c]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x53469b
mov dword [ebp - 0x11c], 0
jmp 0x5346a7
mov dword [ebp - 0x11c], 0xffffffd8
cmp dword [ebp - 4], 0
je 0x534708
mov dword [ebp - 8], 1
jmp 0x5346bf
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
movzx edx, word [ebp + 0x18]
cmp dword [ebp - 8], edx
jge 0x5346f5
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax*4], 0
je 0x5346f3
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.005363c0
add esp, 4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [eax + edx*4], 0
jmp 0x5346b6
mov ecx, dword [ebp - 4]
push ecx
call fcn.005363c0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret

Function at 0x538320
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40c], 0
push 0x400
lea eax, [ebp - 0x408]
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x538367
lea ecx, [ebp - 0x408]
push ecx
call fcn.00538780
add esp, 4
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret
Function at 0x538780
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 1
call fcn.00539380
add esp, 4
test eax, eax
jne 0x5387c5
mov eax, dword [ebp - 0xc]
jmp 0x5388a6
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0058a340
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5387f0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x41c], edx
jmp 0x5387f9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x538821
mov edx, dword [ebp - 8]
push edx
call fcn.0047252f
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0x14], 0
jne 0x53882c
mov eax, dword [ebp - 0xc]
jmp 0x5388a6
push 0x400
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x14]
movsx edx, word [ecx + 8]
push edx
call fcn.00538a50
add esp, 0x10
test eax, eax
jne 0x53885a
mov eax, dword [ebp - 0xc]
jmp 0x5388a6
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
movsx edx, word [ecx + 8]
push edx
call fcn.00539230
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
movsx ecx, word [eax + 8]
push ecx
mov edx, dword [ebp - 0x14]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00539330
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret
Function at 0x539380
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x60e970], 0
je 0x5393a3
mov eax, 1
jmp 0x5393e1
mov word [ebp - 0x19c], 0x101
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x19c]
push ecx
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x5393d2
call sub.WSOCK32.dll_WSAGetLastError
call sub.WSOCK32.dll_WSACleanup
xor eax, eax
jmp 0x5393e1
mov dword [0x60e970], 1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret

Function at 0x5393f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll_getsockname
test eax, eax
jge 0x53942d
xor eax, eax
jmp 0x539463
movsx ecx, word [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 2
jne 0x53945a
push 0x30
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00538a50
add esp, 0x10
test eax, eax
jne 0x539458
xor eax, eax
jmp 0x539463
jmp 0x53945e
xor eax, eax
jmp 0x539463
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret
Function at 0x53bbe0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
push eax
call fcn.0053d270
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0053d0e0
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x53bcda
push 0
call fcn.0053bd70
add esp, 4
push 1
call fcn.0053bd70
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x53bcda
mov eax, dword [ebp - 0x10]
push eax
call fcn.005363c0
add esp, 4
cmp dword [ebp + 8], 0
je 0x53bcd0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x80], 0
je 0x53bc9f
xor edx, edx
je 0x53bc9f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x14], ecx
jmp 0x53bca6
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0052cd20
add esp, 0x1c
mov eax, 1
jmp 0x53bd64
mov edx, dword [ebp - 0x10]
push edx
call fcn.005363c0
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x53bd02
cmp dword [ebp + 0x14], 0
jne 0x53bd12
mov eax, dword [ebp + 0x10]
push eax
call fcn.00471d80
add esp, 4
test eax, eax
jne 0x53bd12
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x53bd58
cmp dword [ebp + 0x14], 0
je 0x53bd20
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x53bd32
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00471d80
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
xor ecx, ecx
cmp dword [ebp + 0x14], 0
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0058b260
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x53d270
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x53d290
mov eax, reloc.WSOCK32.dll_accept
jmp 0x53d2dc
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.004720b0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x53d2d7
cmp dword [ebp + 8], 0
jne 0x53d2d7
cmp dword [ebp - 0x9c], 6
jb 0x53d2d7
mov eax, reloc.WSOCK32.dll_accept
jmp 0x53d2dc
mov eax, reloc.WSOCK32.dll_bind
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret
Function at 0x542d80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x542da1
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_setsockopt
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x556740
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x556754
mov eax, dword [ebp + 0x10]
mov dword [0x658b90], eax
jmp 0x55675e
mov dword [0x658b90], 0xffffffff
mov ecx, dword [ebp + 0x14]
mov dword [0x658b84], ecx
cmp dword [0x60fea4], 0
je 0x55677f
mov edx, dword [0x658b80]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x5567f0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x658b80], eax
cmp dword [0x658b80], 0
jne 0x55679f
xor eax, eax
jmp 0x5567f5
push 4
push 1
call fcn.0047a107
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5567b8
xor eax, eax
jmp 0x5567f5
mov eax, dword [ebp - 4]
mov ecx, dword [0x658b80]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x5566b0
call fcn.0047cf55
add esp, 0xc
mov dword [0x60fea4], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x60fea4], 0
jne 0x5567f0
xor eax, eax
jmp 0x5567f5
mov eax, dword [0x60fea4]
mov esp, ebp
pop ebp
ret

Function at 0x556830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.0047198d
add esp, 4
mov dword [0x60fa98], eax
cmp dword [0x60fa98], 0
je 0x556857
mov eax, dword [0x60fa98]
jmp 0x5568d2
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push str.SOFTWAREFLEXlm_License_Manager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5568d0
mov dword [ebp - 0xc], 0x400
lea edx, [ebp - 0xc]
push edx
push 0x60faa0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5568c2
mov dword [0x60fa98], 0x60faa0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x60fa98]
jmp 0x5568d2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x5568d2
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5576f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x40], 0xc
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0xe3
mov byte [ebp - 0x3d], 0xa8
mov byte [ebp - 0x3c], 0xf6
mov byte [ebp - 0x3b], 0xd4
mov byte [ebp - 0x3a], 0xc7
mov byte [ebp - 0x39], 0x68
mov byte [ebp - 0x38], 0xf2
mov byte [ebp - 0x37], 0x36
mov byte [ebp - 0x36], 0x1c
mov byte [ebp - 0x35], 0x88
mov byte [ebp - 0x34], 0x15
mov byte [ebp - 0x33], 0x36
mov byte [ebp - 0x32], 0x97
mov byte [ebp - 0x31], 0xde
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x9a
mov byte [ebp - 0x2e], 0x9e
mov byte [ebp - 0x2d], 0xdf
mov byte [ebp - 0x2c], 5
mov byte [ebp - 0x2b], 0xd5
mov byte [ebp - 0x2a], 0xf3
mov byte [ebp - 0x29], 0x52
mov byte [ebp - 0x28], 0xe1
mov byte [ebp - 0x27], 0xe1
mov byte [ebp - 0x26], 0xcb
mov byte [ebp - 0x25], 0xfb
mov byte [ebp - 0x24], 0xb4
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0xca
mov byte [ebp - 0x20], 0x29
mov byte [ebp - 0x1f], 0xed
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x1c], 0x6a
mov byte [ebp - 0x1b], 0xba
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0xa1
mov byte [ebp - 0x18], 0xb0
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0x27
mov byte [ebp - 0x15], 0x60
mov byte [ebp - 0x14], 0x87
mov byte [ebp - 0x13], 0x81
mov byte [ebp - 0x12], 0xd1
mov byte [ebp - 0x11], 0xa4
mov byte [ebp - 0x10], 0x10
mov byte [ebp - 0xf], 0xf7
mov byte [ebp - 0xe], 0xd2
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0xce
mov byte [ebp - 0xb], 0xb5
mov byte [ebp - 0xa], 0x12
mov byte [ebp - 9], 0xc5
mov dword [ebp - 0x44], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x44]
ja 0x557811
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004751f0
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret
Function at 0x557830
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xd4]
mov edx, dword [ecx + 0x10a4]
and edx, 0x40
jne 0x557865
xor eax, eax
jmp 0x557a45
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
and ecx, 0x80
jne 0x5578d8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x13c]
or eax, 0x80
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x13c], eax
push str.BUG_B
push 0x45
push 0x44
push str.FLEXLM__c_c_sADDATE
lea edx, [ebp - 0x2d0]
push edx
call fcn.00471bce
add esp, 0x14
lea eax, [ebp - 0x2d0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0053c430
add esp, 8
test eax, eax
je 0x5578d8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x13c]
or eax, 0x100
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x13c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x13c]
and eax, 0x100
je 0x55794a
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x80], 0
je 0x557909
xor edx, edx
je 0x557909
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x2d4], ecx
jmp 0x557913
mov dword [ebp - 0x2d4], 0xffffffa8
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2d4]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x138
push 0xffffffffffffffa8
mov ecx, dword [ebp + 8]
push ecx
call fcn.0052cd20
add esp, 0x1c
mov eax, 0xffffffa8
jmp 0x557a45
mov byte [ebp - 0x208], 0x5c
mov byte [ebp - 0x207], 0
push 0
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00557a60
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x55797e
mov eax, dword [ebp - 4]
jmp 0x557a45
push 0x200
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00557a60
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5579b6
mov eax, dword [ebp - 4]
jmp 0x557a45
mov byte [ebp - 0x208], 0x2f
mov byte [ebp - 0x206], 0x61
mov byte [ebp - 0x205], 0x72
mov byte [ebp - 0x207], 0x76
mov byte [ebp - 0x204], 0
push 0
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00557a60
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5579fc
mov eax, dword [ebp - 4]
jmp 0x557a45
mov byte [ebp - 0x208], 0x2f
mov byte [ebp - 0x204], 0
mov byte [ebp - 0x206], 0x6d
mov byte [ebp - 0x207], 0x74
mov byte [ebp - 0x205], 0x70
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00557a60
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x557a42
mov eax, dword [ebp - 4]
jmp 0x557a45
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret
Function at 0x5749d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov byte [ebp - 8], cl
mov edx, dword [ebp + 0x10]
sar edx, 8
and edx, 0xff
mov byte [ebp - 7], dl
mov eax, dword [ebp + 0x10]
sar eax, 0x10
and eax, 0xff
mov byte [ebp - 6], al
mov ecx, dword [ebp + 0x10]
sar ecx, 0x18
and ecx, 0xff
mov byte [ebp - 5], cl
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
test edx, edx
je 0x574a61
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 8]
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
mov byte [edx], cl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jle 0x574a56
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x574a1b
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x57f2d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0x5f4e44
lea eax, [ebp - 0x28]
push eax
call fcn.00471610
add esp, 8
mov dword [ebp - 0x10], 0
jmp 0x57f303
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 3
jge 0x57f324
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x57f31a
jmp 0x57f324
mov al, byte [ebp - 0x28]
add al, 1
mov byte [ebp - 0x28], al
jmp 0x57f2fa
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047209e
mov esp, ebp
pop ebp
ret

Function at 0x57fb90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x658d50
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005ba420
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005ba630
add esp, 8
push 0x40
push 0x1000
mov edx, dword [ebp - 0xc]
add edx, 0xa
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x57fbe4
xor eax, eax
jmp 0x57fc19
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004751f0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.004720b0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call fcn.005363c0
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret