joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
lea eax, [esp + 0xc]
push esi
push eax
push 0x1968
mov dword [esp + 0x30], 0x47ae147b
mov dword [esp + 0x34], 0x3fe47ae1
mov dword [esp + 0x38], 0x51eb851f
mov dword [esp + 0x3c], 0x3fd51eb8
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x3ff00000
mov dword [esp + 0x48], 0x33333333
mov dword [esp + 0x4c], 0x3fd33333
mov dword [esp + 0x50], 0x33333333
mov dword [esp + 0x54], 0x3fe33333
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0x3ff00000
mov dword [esp + 0x60], 0x33333333
mov dword [esp + 0x64], 0x3fc33333
mov dword [esp + 0x68], 0xeb851eb8
mov dword [esp + 0x6c], 0x3faeb851
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0x3ff00000
call fcn.00542880
call fcn.0050f840
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.0050f3e0
mov ecx, dword [esp + 0x18]
mov esi, eax
push ecx
call fcn.00542180
push 0x6f5e78
push 0x646d6e64
push esi
call fcn.0050bbd0
push 0x6f5eac
push 0x646d6464
push esi
call fcn.0050bbd0
push 0x6f5eac
push 0x64657363
push esi
call fcn.0050bbd0
add esp, 0x3c
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x50fd80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x50fdb0
push esi
call fcn.0054a670
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x50fda9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x50fe33
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x50fe1f
mov eax, dword [esi + 8]
test eax, eax
je 0x50fdd4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x50fe1b
cmp eax, 2
je 0x50fe1f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x50fdc7
cmp eax, 3
je 0x50fdfa
cmp eax, 1
jne 0x50fdc7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x50fdc7
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x50fdc7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0050fe60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x50fe53
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0050fe60
add esp, 4
pop esi
ret
Function at 0x50fe60
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xcc
je 0x50fe88
mov eax, dword [esi + 0x180]
push esi
call dword [eax]
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x180]
mov al, byte [ecx + 8]
test al, al
je 0x50feb3
mov edx, dword [esi]
push esi
mov dword [edx + 0x14], 0x30
mov eax, dword [esi]
call dword [eax]
mov ecx, dword [esi + 0x180]
add esp, 4
mov al, byte [ecx + 8]
test al, al
jne 0x50fe95
mov cl, byte [esi + 0x41]
xor edx, edx
test cl, cl
setne dl
add edx, 0xcd
mov al, 1
mov dword [esi + 0x14], edx
pop esi
ret

Function at 0x51d340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov bl, byte [ebp]
cmp bl, 0x75
jne 0x51d406
cmp byte [ebp + 1], 0x6e
jne 0x51d3b4
cmp byte [ebp + 2], 0x69
jne 0x51d3b4
xor eax, eax
lea esi, [ebp + 3]
mov edi, 4
mov cl, byte [esi]
mov byte [esp + 0x14], cl
mov edx, dword [esp + 0x14]
and edx, 0xff
lea ecx, [edx - 0x30]
cmp ecx, 0xa
jb 0x51d38d
lea ecx, [edx - 0x41]
cmp ecx, 6
jae 0x51d39d
add ecx, 0xa
cmp ecx, 0x10
jae 0x51d39d
shl eax, 4
add eax, ecx
dec edi
inc esi
test edi, edi
jg 0x51d36a
test edi, edi
jne 0x51d3b4
mov cl, byte [esi]
test cl, cl
je 0x51d450
cmp cl, 0x2e
je 0x51d44b
cmp bl, 0x75
jne 0x51d406
xor eax, eax
lea esi, [ebp + 1]
mov edi, 6
mov dl, byte [esi]
mov byte [esp + 0x14], dl
mov edx, dword [esp + 0x14]
and edx, 0xff
lea ecx, [edx - 0x30]
cmp ecx, 0xa
jb 0x51d3e6
lea ecx, [edx - 0x41]
cmp ecx, 6
jae 0x51d3f6
add ecx, 0xa
cmp ecx, 0x10
jae 0x51d3f6
shl eax, 4
add eax, ecx
dec edi
inc esi
test edi, edi
jg 0x51d3c3
cmp edi, 2
jg 0x51d406
mov cl, byte [esi]
test cl, cl
je 0x51d450
cmp cl, 0x2e
je 0x51d44b
test bl, bl
mov eax, ebp
je 0x51d432
mov cl, bl
cmp cl, 0x2e
jne 0x51d417
cmp eax, ebp
ja 0x51d42e
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x51d40e
push eax
push ebp
call fcn.0051d6d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test eax, eax
jne 0x51d441
push eax
push ebp
call fcn.0051d6d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
push ebp
call fcn.0051d6d0
add esp, 8
xor eax, 0x80000000
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x53d8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea eax, [esp + 0x68]
push esi
push eax
call fcn.0053dd10
mov ebx, dword [ebp + 8]
add esp, 8
cmp dword [ebx + 0x28], 4
jne 0x53d8ff
mov si, word [esi + 6]
jmp 0x53d901
xor esi, esi
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x53d93a
mov dword [esp + 0x30], 0x33333333
mov dword [esp + 0x34], 0x3fd33333
mov dword [esp + 0x28], 0x33333333
mov dword [esp + 0x2c], 0x3fd33333
mov dword [esp + 0x20], 0x33333333
mov dword [esp + 0x24], 0x3fd33333
jmp 0x53d948
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0053dd10
add esp, 8
mov dword [esp + 0x18], 0x78b58c40
mov dword [esp + 0x1c], 0x4415af1d
xor edi, edi
lea edx, [esp + 0x50]
lea eax, [esp + 0x20]
push edx
push esi
push eax
push ebx
call fcn.0053daa0
lea ecx, [esp + 0x78]
lea edx, [esp + 0x60]
push ecx
push edx
call fcn.00541aa0
fcom qword [esp + 0x30]
add esp, 0x18
fnstsw ax
test ah, 1
je 0x53da64
fstp qword [esp + 0x18]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.0053dc90
lea edx, [esp + 0x28]
push esi
lea eax, [esp + 0x8c]
push edx
push eax
push ebx
mov word [esp + 0x2e], si
call fcn.0053db90
lea ecx, [esp + 0x38]
lea edx, [esp + 0x98]
push ecx
lea eax, [esp + 0x54]
push edx
push eax
call fcn.00541ec0
fld qword [esp + 0x8c]
fsub qword [esp + 0x74]
lea ecx, [esp + 0x5c]
push ecx
fadd qword [esp + 0x60]
fstp qword [esp + 0x60]
fld qword [esp + 0x98]
fsub qword [esp + 0x80]
fadd qword [esp + 0x68]
fstp qword [esp + 0x68]
fld qword [esp + 0xa0]
fsub qword [esp + 0x88]
fadd qword [esp + 0x70]
fstp qword [esp + 0x70]
call fcn.00541a50
lea edx, [esp + 0xf0]
lea eax, [esp + 0xa8]
push edx
push eax
call fcn.00541cd0
add esp, 0x30
test eax, eax
jl 0x53da66
lea ecx, [esp + 0x38]
lea edx, [esp + 0xc8]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call fcn.00541ec0
lea ecx, [esp + 0x2c]
push ecx
call fcn.00541a50
add esp, 0x10
inc edi
cmp edi, 0x1e
jl 0x53d95a
jmp 0x53da66
fstp st(0)
mov eax, dword [ebp + 0x10]
mov dx, word [esp + 0x10]
mov cx, word [esp + 0x12]
pop edi
fld qword [esp + 0x14]
mov word [eax], dx
mov dx, word [esp + 0x10]
mov word [eax + 2], cx
mov cx, word [esp + 0x12]
pop esi
mov word [eax + 4], dx
mov word [eax + 6], cx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5420b0
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
test eax, eax
jle 0x542112
push edi
mov edi, eax
mov eax, dword [esp + 0xc]
mov cl, byte [esi]
inc esi
mov byte [esp + 0xc], cl
mov ecx, 8
mov edx, dword [esp + 0xc]
test eax, 0x80000000
je 0x5420f2
and edx, 0xff
add eax, eax
shr edx, 7
xor edx, eax
xor edx, 0x4c11db7
mov eax, edx
jmp 0x5420ff
and edx, 0xff
add eax, eax
shr edx, 7
xor eax, edx
mov dl, byte [esp + 0xc]
shl dl, 1
dec ecx
mov byte [esp + 0xc], dl
jne 0x5420d0
dec edi
jne 0x5420c4
pop edi
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret
Function at 0x56a3c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x665ce8
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.0056a0e0
test eax, eax
je 0x56a455
push esi
call fcn.0055fe10
mov ecx, dword [eax + 4]
add esp, 4
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
je 0x56a455
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
test eax, eax
je 0x56a40a
add eax, 0xc
jmp 0x56a40f
mov eax, 0x7427d8
push eax
lea ecx, [esp + 0x18]
call fcn.00628882
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x10], 0
call dword [edx + 0x30]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.00628814
mov eax, 1
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
mov ecx, dword [esp + 4]
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
Function at 0x5725d0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x108
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
push 0xffffffffffffffff
jne 0x572614
lea edx, [esp + 0x10]
push edx
jmp 0x572619
push 0x72334c
mov esi, dword [esp + 0x11c]
mov ecx, esi
call fcn.00499a80
mov eax, esi
pop edi
pop esi
add esp, 0x108
ret
Function at 0x57a4b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x666fc8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
call fcn.00578bc0
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x57a5dd
mov edx, 0x6e5b2c
mov eax, edx
mov dword [esp + 0x10], edx
test eax, eax
je 0x57a4fd
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x57a501
mov dword [esp + 0x14], ebx
mov ecx, edx
mov dword [esp + 0x18], edx
test ecx, ecx
je 0x57a51d
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x57a521
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00498950
mov edi, 0x6edbd0
mov dword [esp + 0x30], ebx
mov edx, edi
mov dword [esp + 0x20], edi
test edx, edx
je 0x57a55a
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
jmp 0x57a55e
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
call fcn.00499da0
test al, al
je 0x57a5cc
mov edi, 0x6f1b28
mov ecx, edi
mov dword [esp + 0x20], edi
test ecx, ecx
je 0x57a58f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
jmp 0x57a593
mov dword [esp + 0x24], ebx
lea edx, [esp + 0x20]
push ebx
push edx
mov ecx, esi
call fcn.004989f0
cmp eax, ebx
je 0x57a5cc
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00499a60
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00499a60
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x57c170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 1
push 0
push ecx
push SysReAllocStringLen
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57c1c3
mov ecx, dword [esp]
lea edx, [esp + 4]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 4]
xor eax, eax
cmp eax, edx
sbb eax, eax
neg eax
add esp, 8
ret

Function at 0x57c210
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 1
push 0
push ecx
push SysReAllocStringLen
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57c271
mov ecx, dword [esp]
lea edx, [esp + 0xc]
lea eax, [esp + 4]
push edx
push eax
push 0
push 0
push 0x723430
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 8
ret
Function at 0x57c310
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24
push esi
push edi
mov ecx, 8
xor eax, eax
lea edi, [esp + 0xc]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
push 1
push esi
push ecx
push SysReAllocStringLen
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57c373
mov ecx, dword [esp + 8]
lea edx, [esp + 0x30]
lea eax, [esp + 0xc]
push edx
push eax
push esi
push esi
push 0x72343c
push ecx
mov dword [esp + 0x48], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0xc]
push 0x723460
push eax
call fcn.00466a9e
add esp, 8
test eax, eax
jne 0x57c394
pop edi
mov eax, 1
pop esi
add esp, 0x24
ret
lea ecx, [esp + 0xc]
push 0x723458
push ecx
call fcn.00466a9e
add esp, 8
test eax, eax
jne 0x57c3b5
pop edi
mov eax, 2
pop esi
add esp, 0x24
ret
lea edx, [esp + 0xc]
push 0x723450
push edx
call fcn.00466a9e
add esp, 8
test eax, eax
jne 0x57c3d6
pop edi
mov eax, 3
pop esi
add esp, 0x24
ret
lea eax, [esp + 0xc]
push 0x6e6ee8
push eax
call fcn.00466a9e
add esp, 8
test eax, eax
jne 0x57c3f7
pop edi
mov eax, 4
pop esi
add esp, 0x24
ret
lea ecx, [esp + 0xc]
push 0x723468
push ecx
call fcn.00466a9e
add esp, 8
test eax, eax
mov eax, 5
je 0x57c414
mov eax, esi
pop edi
pop esi
add esp, 0x24
ret
Function at 0x57c420
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x6672c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0x28]
call fcn.00582070
lea eax, [esp + 0x28]
xor ebp, ebp
push eax
mov ecx, esi
mov dword [esp + 0x44], ebp
call fcn.0057a080
lea ecx, [esp + 0x18]
call fcn.004c50a0
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x40], 1
push ecx
lea ecx, [esp + 0x1c]
call fcn.004c5270
cmp dword [esp + 0x30], ebp
jbe 0x57c517
mov esi, dword [esp + 0x2c]
push ebx
push edi
mov ebx, 0x6e5e1c
mov edx, ebx
mov dword [esp + 0x10], ebx
test edx, edx
je 0x57c4a4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x57c4ac
mov dword [esp + 0x14], 0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
call fcn.004c5210
mov ecx, dword [esi]
push ecx
lea ecx, [esp + 0x24]
call fcn.004c5270
mov edx, ebx
mov dword [esp + 0x18], ebx
test edx, edx
je 0x57c4e2
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x57c4ea
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
call fcn.004c5210
mov ecx, dword [esi + 4]
push ecx
lea ecx, [esp + 0x24]
call fcn.004c5270
mov eax, dword [esp + 0x38]
inc ebp
add esi, 8
cmp ebp, eax
jb 0x57c488
pop edi
pop ebx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
inc edx
push edx
push eax
push 1
push 0
push 0x723470
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edx, edx
lea ecx, [esp + 0x18]
test eax, eax
sete dl
mov esi, edx
mov byte [esp + 0x40], 0
call fcn.004c50c0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xffffffff
call fcn.005820e0
mov ecx, dword [esp + 0x38]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x57c580
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x6672f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push esi
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
call fcn.00582070
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x70], 1
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 8]
push eax
push 1
push 0
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57c616
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push 0
push 0x723470
push ecx
mov dword [esp + 0x28], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
call fcn.00628882
mov ecx, dword [esp + 0xc]
push 0x6e5e1c
push ecx
mov byte [esp + 0x78], 2
call fcn.0061e432
add esp, 8
test eax, eax
je 0x57c6e8
push eax
call fcn.004669a5
add esp, 4
mov dword [esp + 0x24], eax
xor esi, esi
push 0x6e5e1c
push 0
call fcn.0061e432
add esp, 8
test eax, eax
je 0x57c668
inc esi
jmp 0x57c652
mov eax, esi
cdq
sub eax, edx
mov edi, eax
sar edi, 1
test edi, edi
jle 0x57c6df
push ebp
push edi
lea ecx, [esp + 0x20]
call fcn.00582130
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x2c]
push 0x6e5e1c
push edx
call fcn.0061e432
add esp, 8
xor ebp, ebp
test edi, edi
jle 0x57c6de
push 0x6e5e1c
push 0
call fcn.0061e432
add esp, 8
test eax, eax
je 0x57c6de
push eax
call fcn.004669a5
push 0x6e5e1c
push 0
mov dword [esi], eax
call fcn.0061e432
add esp, 0xc
test eax, eax
je 0x57c6de
push eax
call fcn.004669a5
add esp, 4
mov dword [esi + 4], eax
inc ebp
add esi, 8
cmp ebp, edi
jl 0x57c69c
pop ebp
lea ecx, [esp + 0x18]
call fcn.005822b0
mov esi, dword [esp + 0x78]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.005820b0
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x70], 1
call fcn.00628814
lea ecx, [esp + 0x18]
mov byte [esp + 0x70], 0
call fcn.005820e0
mov ecx, dword [esp + 0x68]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x6c
ret

Function at 0x57c760
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 1
push 0
push ecx
push SysReAllocStringLen
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57c7c1
mov ecx, dword [esp]
lea edx, [esp + 0xc]
lea eax, [esp + 4]
push edx
push eax
push 0
push 0
push 0x72347c
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 8
ret
Function at 0x57c800
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 1
push 0
push ecx
push SysReAllocStringLen
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57c861
mov ecx, dword [esp]
lea edx, [esp + 0xc]
lea eax, [esp + 4]
push edx
push eax
push 0
push 0
push 0x72348c
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x57c870
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00578700
test eax, eax
je 0x57c8b1
mov ecx, esi
call fcn.0057ba90
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push 4
push eax
push 4
push 0
push 0x723494
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
pop esi
test eax, eax
sete cl
mov eax, ecx
pop ecx
ret 4
mov edx, dword [esp + 0xc]
push 0x723494
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor ecx, ecx
pop esi
test eax, eax
sete cl
mov eax, ecx
pop ecx
ret 4

Function at 0x57c8d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 1
push 0
push ecx
push SysReAllocStringLen
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57c931
mov ecx, dword [esp]
lea edx, [esp + 0xc]
lea eax, [esp + 4]
push edx
push eax
push 0
push 0
push 0x723494
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 8
ret
Function at 0x57dba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [esp + 0x38]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x30], ebx
je 0x57dda3
mov edx, dword [eax + 0x54]
mov edi, 0x6f1a64
mov eax, edi
mov dword [esp + 0x10], edi
test eax, eax
je 0x57dbef
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x57dbf3
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
push ecx
mov ecx, edx
call fcn.00498ab0
mov esi, eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.004e65d0
add esp, 8
cmp esi, ebx
mov byte [esp + 0x30], 1
je 0x57dd95
cmp dword [esp + 0xc], ebx
je 0x57dd95
mov edi, 0x6f1c90
mov ecx, edi
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x57dc49
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x57dc4d
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.00498ab0
mov edx, eax
cmp edx, ebx
je 0x57dd95
mov eax, 0x6e6d54
mov dword [esp + 0x10], 0x6e6d54
test eax, eax
je 0x57dc86
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x57dc8a
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
push ecx
mov ecx, edx
call fcn.00498ab0
cmp eax, ebx
je 0x57dd95
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x57dcb6
lea edx, [ecx + 0xc]
mov dword [esp + 0x10], edx
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], ecx
jmp 0x57dcbe
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x10]
mov ecx, eax
push edx
call fcn.00498ab0
mov esi, eax
cmp esi, ebx
je 0x57dd95
mov edi, 0x6e53c0
mov eax, edi
mov dword [esp + 0x18], edi
test eax, eax
je 0x57dcf3
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x57dcf7
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004988b0
mov edx, eax
mov eax, 0x6e6d54
mov byte [esp + 0x30], 2
test eax, eax
mov dword [esp + 0x20], 0x6e6d54
je 0x57dd32
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
jmp 0x57dd36
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x20]
push ecx
mov ecx, edx
call fcn.00499da0
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x30], 1
call fcn.00499a60
test bl, bl
je 0x57dd95
mov ecx, dword [esp + 0x38]
push esi
call fcn.004b7610
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x30], 0
call fcn.00499a60
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.00499a60
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00499a60
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.00499a60
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret