joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594a70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.004c4b70
mov edx, dword [esp + 0x1c]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
test edx, edx
je 0x594bc4
push ebx
push edi
mov edi, dword [esp + 0x30]
cmp edx, 8
jb 0x594ba7
lea eax, [ebp - 1]
lea ebx, [edi - 1]
add eax, edx
add ebx, edx
cmp edi, eax
ja 0x594ab7
cmp ebx, ebp
jae 0x594ba7
lea eax, [edx - 1]
add eax, esi
cmp edi, eax
ja 0x594ac8
cmp ebx, esi
jae 0x594ba7
cmp edx, 0x40
jb 0x594b68
mov ebx, edx
mov eax, edx
and ebx, 0x3f
mov edx, edi
sub edx, ebp
mov dword [esp + 0x1c], ebx
sub eax, ebx
mov dword [esp + 0x10], edx
mov ebx, esi
mov dword [esp + 0x18], eax
sub ebx, ebp
lea eax, [ebp + 0x10]
mov ebp, dword [esp + 0x10]
mov edx, esi
sub edx, edi
mov dword [esp + 0x14], edx
lea edx, [edi + 0x20]
movups xmm0, xmmword [eax - 0x10]
mov edi, dword [esp + 0x14]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx + esi]
lea edx, [edx + 0x40]
xorps xmm1, xmm0
movups xmmword [edx - 0x60], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [ebx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax + ebp - 0x40], xmm1
movups xmm1, xmmword [edi + edx - 0x40]
mov edi, dword [esp + 0x30]
movups xmm0, xmmword [eax - 0x30]
xorps xmm1, xmm0
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [esi + ecx + 0x30]
add ecx, 0x40
movups xmm0, xmmword [eax - 0x20]
xorps xmm1, xmm0
movups xmmword [edx - 0x30], xmm1
cmp ecx, dword [esp + 0x18]
jb 0x594b00
cmp dword [esp + 0x1c], 8
mov edx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
jb 0x594ba3
jmp 0x594b6c
mov ebx, esi
sub ebx, ebp
mov eax, edx
and eax, 0xfffffff8
sub edi, ebp
mov dword [esp + 0x1c], eax
lea eax, [ecx + ebp]
mov dword [esp + 0x2c], edi
nop
movq xmm1, qword [eax + ebx]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [eax + edi - 8], xmm1
cmp ecx, dword [esp + 0x1c]
jb 0x594b80
mov edi, dword [esp + 0x30]
cmp ecx, edx
jae 0x594bc2
sub esi, ebp
lea eax, [ecx + ebp]
sub edi, ebp
sub edx, ecx
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [edi + eax - 1], cl
sub edx, 1
jne 0x594bb0
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x594ce0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.004c4b70
mov ecx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ebp, [ecx + 0x40]
mov esi, dword [ecx + 0x14]
cmp edi, esi
ja 0x594d0e
shl edi, 4
add edi, dword [ebp]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
mov edx, dword [ecx + 0x18]
cmp edi, edx
jb 0x594d48
mov eax, edi
sub eax, edx
add eax, 4
and eax, 0xfffffffc
add eax, edx
push 0x71
mov dword [ecx + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp]
call fcn.00507aa0
add esp, 0x10
test eax, eax
jne 0x594d45
pop edi
pop esi
pop ebp
add esp, 8
ret
mov dword [ebp], eax
mov eax, esi
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, edi
mov edi, dword [esp + 0x10]
sub eax, esi
mov dword [esp + 0xc], eax
push ebx
nop
mov eax, dword [ebp]
add eax, edi
mov bl, byte [eax]
lea esi, [eax + 0x10]
push esi
shr bl, 7
push 1
neg bl
push eax
and bl, 0x87
call fcn.005949e0
xor byte [esi + 0xf], bl
add esp, 0xc
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x594d60
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
pop ebx
mov dword [eax + 0x14], edi
shl edi, 4
add edi, dword [eax + 0x40]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x598850
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x598864
mov dword [esp + 0x18], fcn.00597080
jmp fcn.00590310
mov dword [esp + 0x18], fcn.00596320
jmp fcn.00590010
Function at 0x5a3da0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.004c4b70
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x5a3fb8
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x5a3f92
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x5a3de4
mov esi, dword [esp + 0x30]
jmp 0x5a3f96
mov ecx, dword [esp + 0x28]
push ecx
call fcn.005a34e0
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x5a3dd0
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x5a4310
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.004c4b70
mov eax, dword [0x671580]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa4]
test eax, eax
je 0x5a44a1
push ebx
push esi
mov esi, dword [esp + 0xb0]
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x14], eax
nop dword [eax + eax]
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ebx, byte [esi - 8]
movzx ecx, byte [esi - 4]
shl eax, 8
or ebx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [esi - 3]
shl eax, 8
or ecx, eax
mov dword [esp + 0x18], ebx
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x20], ebx
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edi]
and al, 0xdf
mov dword [esp + 0x10], ecx
or al, 0x40
mov dword [esp + 0x1c], ecx
mov byte [edi], al
movzx eax, byte [ebp]
and al, 0xbf
mov dword [esp + 0x24], ecx
or al, 0x20
push edi
mov byte [ebp], al
call fcn.00520760
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.00520520
push 1
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00402b00
push ebp
call fcn.00520760
lea eax, [esp + 0x44]
push eax
push ebp
call fcn.00520520
push 1
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00402b00
mov eax, dword [esp + 0x40]
add esp, 0x30
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor eax, dword [esp + 0x24]
xor edx, ebx
xor ebx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, ebx
shr eax, 8
mov byte [edi + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, ecx
mov byte [edi], bl
shr ebx, 0x18
shr eax, 8
mov byte [edi + 5], al
mov eax, ecx
mov byte [edi + 3], bl
mov byte [edi + 4], cl
shr eax, 0x10
mov byte [edi + 6], al
mov eax, edx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp + 2], al
mov byte [edi + 7], cl
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 8
mov byte [ebp + 5], al
mov eax, ecx
mov byte [ebp], dl
shr edx, 0x18
mov byte [ebp + 4], cl
shr eax, 0x10
shr ecx, 0x18
sub dword [esp + 0x14], 1
mov byte [ebp + 3], dl
mov byte [ebp + 6], al
mov byte [ebp + 7], cl
jne 0x5a4360
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9c]
pop ebp
xor ecx, esp
call fcn.004c4309
add esp, 0x9c
ret
Function at 0x5bf0f0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x41c
mov eax, dword [0x671580]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
mov ebx, dword [esp + 0x424]
push esi
mov esi, dword [esp + 0x42c]
push edi
mov edi, ecx
test ebx, ebx
jne 0x5bf11f
xor al, al
jmp 0x5bf157
mov eax, dword [edi + 4]
lea ecx, [esp + 0xc]
push ecx
or eax, 0x20019
mov dword [esp + 0x10], 0
push eax
push esi
push ebx
mov ecx, edi
call fcn.005bfaf0
test al, al
je 0x5bf155
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0
je 0x5bf171
mov byte [edi + 1], 1
mov al, 1
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c4309
add esp, 0x41c
ret 8
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x5bf17b
mov eax, dword [esi]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x5bf155
cmp dword [esi + 0x14], 7
jbe 0x5bf18f
mov esi, dword [esi]
push 0x412
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004cf790
lea ecx, [esp + 0x1c]
add esp, 0xc
mov eax, ecx
mov edx, 0x208
sub esi, eax
lea eax, [edx + 0x7ffffdf6]
test eax, eax
je 0x5bf1ce
movzx eax, word [esi + ecx]
test ax, ax
je 0x5bf1ce
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x5bf1b0
push dword [edi + 4]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.005c0250
add esp, 0xc
test eax, eax
setne al
jmp 0x5bf157

Function at 0x5bf200
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, ecx
test ebx, ebx
je 0x5bf26a
mov eax, dword [edi + 4]
lea ecx, [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
or eax, 0x20019
push ecx
push eax
push esi
push ebx
mov ecx, edi
mov dword [esp + 0x20], 0
call fcn.005bfaf0
test al, al
je 0x5bf247
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0
je 0x5bf24f
mov byte [edi + 1], 1
pop esi
pop edi
mov al, 1
pop ebx
ret 8
cmp dword [esi + 0x14], 7
jbe 0x5bf257
mov esi, dword [esi]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
test eax, eax
pop edi
sete al
pop ebx
ret 8
pop edi
xor al, al
pop ebx
ret 8
Function at 0x5bf8a0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6ae5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x671580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x5bf8e0
xor al, al
jmp 0x5bfa39
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov edx, esi
cmp dword [esi + 0x14], 7
jbe 0x5bf916
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x4c], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5bf930
sub ecx, dword [ebp - 0x4c]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.0044e360
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push dword [ebp - 0x48]
call fcn.005bff30
mov byte [ebp - 0x41], al
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x5bf9a4
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x5bf997
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5bfa56
push ecx
push edx
call fcn.004c46ad
mov al, byte [ebp - 0x41]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
test al, al
je 0x5bf9c4
cmp byte [edi], cl
je 0x5bf9fe
mov byte [edi + 1], 1
mov al, 1
mov byte [ebp - 0x41], al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x5bfa25
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x5bfa18
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5bfa5b
jmp 0x5bfa18
cmp dword [esi + 0x14], 7
jbe 0x5bfa06
mov esi, dword [esi]
push esi
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x5bf9c4
xor al, al
jmp 0x5bf9c6
push ecx
push edx
call fcn.004c46ad
mov al, byte [ebp - 0x41]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4309
mov esp, ebp
pop ebp
ret 8
call fcn.004d91aa
call fcn.004d91aa
int3
Function at 0x5c0250
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x671580]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x228]
lea eax, [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x228]
push 0x208
push 0
push eax
call fcn.004cf790
add esp, 0xc
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x5c03f3
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x234]
or eax, 0x20019
push eax
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5c02da
cmp eax, 2
je 0x5c03f3
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004c4309
add esp, 0x21c
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebx + eax*2 - 2], 0x5c
lea edi, [ebx + eax*2]
je 0x5c02fd
mov eax, 0x5c
mov word [edi], ax
add edi, 2
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x5c03be
push esi
lea esi, [esp + 0x20]
sub esi, edi
nop word [eax + eax]
mov edx, 0x208
mov eax, edi
nop word [eax + eax]
lea ecx, [edx + 0x7ffffdf6]
test ecx, ecx
je 0x5c036e
movzx ecx, word [esi + eax]
test cx, cx
je 0x5c036e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x5c0350
push dword [esp + 0x238]
lea ecx, [eax - 2]
test edx, edx
push ebx
cmovne ecx, eax
xor eax, eax
push ebp
mov word [ecx], ax
call fcn.005c0250
add esp, 0xc
test eax, eax
je 0x5c03bd
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x5c0340
pop esi
xor eax, eax
mov word [edi - 2], ax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
pop edi
sbb eax, eax
pop ebp
inc eax
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004c4309
add esp, 0x21c
ret
mov ecx, dword [esp + 0x220]
mov eax, 1
pop ebp
pop ebx
xor ecx, esp
call fcn.004c4309
add esp, 0x21c
ret
Function at 0x5c0430
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6b4d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x671580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], esi
test ecx, ecx
jne 0x5c0479
xor al, al
jmp 0x5c05b1
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
xor edx, edx
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], dx
mov dword [ebp - 4], edx
lea edx, [ebp - 0x28]
push edx
push esi
push ecx
mov ecx, eax
call fcn.005bff30
test al, al
je 0x5c0515
cmp byte [ebp + 0x14], 0
je 0x5c04cf
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.00451210
add esp, 8
test al, al
jne 0x5c050c
jmp 0x5c0515
cmp dword [edi + 0x14], 7
mov edx, edi
jbe 0x5c04d9
mov edx, dword [edi]
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
cmp esi, dword [edi + 0x10]
jne 0x5c0512
test esi, esi
je 0x5c050c
sub eax, edx
mov dword [ebp - 0x34], eax
movzx ecx, word [eax + edx]
movzx eax, word [edx]
cmp cx, ax
jne 0x5c0512
mov eax, dword [ebp - 0x34]
add edx, 2
sub esi, 1
jne 0x5c04f5
mov byte [ebp - 0x29], 1
jmp 0x5c055d
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp byte [eax], 0
je 0x5c0527
mov byte [eax + 1], 1
mov byte [ebp - 0x29], 1
jmp 0x5c055d
cmp dword [edi + 0x14], 7
mov eax, dword [edi + 0x10]
lea eax, [eax*2 + 2]
jbe 0x5c0539
mov edi, dword [edi]
cmp dword [esi + 0x14], 7
jbe 0x5c0541
mov esi, dword [esi]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 0x29], 1
test eax, eax
je 0x5c055d
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x5c059a
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x5c0590
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5c05ce
push ecx
push edx
call fcn.004c46ad
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, byte [ebp - 0x29]
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4309
mov esp, ebp
pop ebp
ret 0x10
call fcn.004d91aa
int3
Function at 0x5c1601
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x5c1622
jl 0x5c1619
test edi, edi
jne 0x5c1622
xor eax, eax
xor edx, edx
jmp 0x5c16e3
cmp dword [ebx + 0x38], 0
je 0x5c1637
push eax
push edi
push dword [ebp + 8]
call fcn.00477d70
jmp 0x5c16e3
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x5c167e
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x5c167e
cmp eax, edi
jb 0x5c1658
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.004cf210
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x5c1684
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x5c16d8
mov ecx, ebx
call fcn.005c0fcc
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x5c16c3
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.005c3eb2
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x5c16d8
jmp 0x5c1696
test edx, edx
je 0x5c16d8
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.005c3eb2
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x5c1a00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6da0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004c4317
mov edi, eax
add esp, 4
test edi, edi
je 0x5c1aa0
push 1
mov dword [ebp - 4], 0
call fcn.00490fa9
add esp, 4
mov dword [edi + 4], eax
jmp 0x5c1aa2
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.00478df0
mov eax, dword [esi + 0xc]
mov ecx, 0
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov edx, dword [ebp + 0xc]
test edx, 1
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, 0x48
cmovne eax, ecx
mov dword [esi], vtable.Poco::Base64EncoderBuf.0
mov ecx, dword [ebp + 8]
mov dword [esi + 0x50], eax
mov dword [esi + 0x40], edx
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov dword [esi + 0x54], eax
mov eax, 0x654df8
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x58], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8