joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b0570
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x49dc]
push edi
test eax, eax
jle 0x5b05fd
mov ecx, dword [esi + 0xc8]
cmp dword [ecx + 0x24], 5
mov ecx, dword [esi + 0x3234]
jne 0x5b05a4
sub eax, ecx
lea edx, [ecx + esi + 0x49e0]
push eax
push edx
mov ecx, esi
call fcn.005ac3b0
jmp 0x5b05bd
push 0
sub eax, ecx
push eax
lea eax, [ecx + esi + 0x49e0]
mov ecx, dword [esi + 0x31f8]
push eax
push ecx
call sub.WS2_32.dll_recv
mov edi, eax
push str.recv_pheader
push edi
mov ecx, esi
call fcn.00562650
mov ecx, eax
test ecx, ecx
je 0x5b05e2
sub eax, 0x2733
neg eax
sbb eax, eax
pop edi
and eax, ecx
pop esi
ret 4
add dword [esi + 0x3234], edi
mov eax, dword [esi + 0x3234]
cmp eax, dword [esi + 0x49dc]
je 0x5b05fd
pop edi
xor eax, eax
pop esi
ret 4
push ebx
mov ecx, esi
call fcn.00561f60
mov edi, dword [esp + 0x10]
xor bl, bl
cmp dword [esi + 0x49dc], 3
jl 0x5b06da
lea edx, [esi + 0x49e0]
push edx
call fcn.0056b060
add esp, 4
mov dword [edi + 8], eax
cmp dword [esi + 0x49dc], 6
jl 0x5b0665
lea eax, [esi + 0x49e3]
push eax
call fcn.0056b060
add esp, 4
mov ecx, edi
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
call fcn.005b2460
cmp dword [esi + 0x49dc], 6
jle 0x5b0665
mov cl, byte [esi + 0x49e6]
mov byte [edi + 5], cl
cmp dword [esi + 0x49dc], 0xb
jne 0x5b0680
lea edx, [esi + 0x49e7]
push edx
call fcn.0057a740
add esp, 4
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0xffffff
jne 0x5b06da
mov eax, dword [esi + 0xc8]
cmp dword [eax + 0x24], 5
jne 0x5b06a5
push 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.005ac3b0
jmp 0x5b06ba
mov eax, dword [esi + 0x31f8]
push 0
push 4
lea edx, [esp + 0x18]
push edx
push eax
call sub.WS2_32.dll_recv
cmp eax, 4
je 0x5b06c8
pop ebx
pop edi
or eax, 0xffffffff
pop esi
ret 4
lea ecx, [esp + 0x10]
push ecx
call fcn.005aa450
add esp, 4
mov dword [edi + 0x14], eax
mov bl, 1
movzx eax, byte [edi + 5]
add eax, 0xfffffff8
xor cl, cl
cmp eax, 0xe
ja case.0x5b06ef.10
movzx edx, byte [eax + 0x5b0770]
jmp dword [edx*4 + 0x5b0768]
mov cl, 1
test bl, bl
jne 0x5b0702
mov eax, dword [edi + 8]
mov dword [edi + 0x14], eax
cmp byte [edi + 0x10], 0
jne 0x5b0716
movzx edx, byte [edi + 6]
mov eax, dword [esi + edx*4 + 0x48b8]
add dword [edi + 0x14], eax
test cl, cl
mov ecx, esi
je 0x5b073d
mov dword [esi + 0xa4], 0x18
call fcn.005a9e50
test eax, eax
jne 0x5b075e
push edi
mov ecx, esi
call fcn.005b08b0
pop ebx
pop edi
pop esi
ret 4
mov dword [esi + 0xa4], 0x17
call fcn.005a9e50
test eax, eax
jne 0x5b075e
push edi
mov ecx, esi
call fcn.005b03f0
pop ebx
pop edi
pop esi
ret 4
pop ebx
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x5b2e20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x664b40
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str._dkf
lea ecx, [ebp - 0x24]
push ecx
call fcn.0062311b
add esp, 0xc
push 0x10
push edi
push 0
push 0
lea edx, [ebp - 0x24]
push edx
mov eax, dword [esi + 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0062023e
mov esp, ebp
pop ebp
ret 8

Function at 0x5b2ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x664b70
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str._dkf
lea ecx, [ebp - 0x24]
push ecx
call fcn.0062311b
add esp, 0xc
mov dword [ebp - 0x2c], 0x10
lea edx, [ebp - 0x2c]
push edx
push edi
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [esi + 0x104]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5b2f68
mov eax, 1
jmp 0x5b2f6a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0062023e
mov esp, ebp
pop ebp
ret 8
Function at 0x5b3be0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x244]
test eax, eax
je 0x5b3c5b
cmp dword [esi + 0x17c], 0
push edi
je 0x5b3c3e
mov ecx, dword [esi + 0x1a8]
test ecx, ecx
je 0x5b3c3e
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.bUseSpeedLimiter
push eax
call edi
mov eax, dword [esi + 0x244]
push 8
lea edx, [esi + 0x170]
push edx
push 0
push 0
push str.psnSpeedLimit
push eax
call edi
pop edi
pop esi
pop ecx
ret
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.bUseSpeedLimiter
push eax
call edi
mov ecx, dword [esi + 0x244]
push str.psnSpeedLimit
push ecx
call edi
pop edi
pop esi
pop ecx
ret

Function at 0x5b3c60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x244]
test eax, eax
je 0x5b3cf8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.bUseSpeedLimiter
push eax
mov dword [esp + 0x20], 4
call edi
test eax, eax
jne 0x5b3cf7
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
mov dword [esi + 0x1a8], eax
mov eax, dword [esi + 0x244]
push str.psnSpeedLimit
push eax
mov dword [esi + 0x17c], 1
mov dword [esp + 0x20], 8
call edi
test eax, eax
jne 0x5b3cf7
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x170], ecx
mov dword [esi + 0x174], edx
mov dword [esi + 0x178], 1
pop edi
pop esi
add esp, 0x10
ret

Function at 0x5b3d00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x244]
test eax, eax
je 0x5b3d76
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push str.nSkFr1
push eax
mov dword [esp + 0x20], 4
call edi
test eax, eax
jne 0x5b3d75
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
mov dword [esi + 0x198], eax
mov eax, dword [esi + 0x244]
push str.dLstDrSk1
push eax
mov dword [esp + 0x20], 8
call edi
test eax, eax
jne 0x5b3d75
fld qword [esp + 0x10]
fstp qword [esi + 0x1a0]
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5b4020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x664c20
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
cmp dword [esi + 0x244], 0
je 0x5b4149
mov dword [ebp - 4], 0
wait
mov eax, dword [esi + 0x1c8]
mov ecx, dword [esi + 0x1cc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
push 8
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x69b69c
mov ecx, dword [esi + 0x244]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
mov eax, dword [esi + 0x1d0]
mov dword [ebp - 0x14], eax
cmp eax, 0x64
jle 0x5b40bb
push 4
lea edx, [ebp - 0x14]
push edx
push 4
push 0
push str.Speed
mov eax, dword [esi + 0x244]
push eax
call edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x24]
cmp ecx, 4
je 0x5b40d4
cmp ecx, 5
je 0x5b40d4
cmp dword [eax + 0x334], 0
je 0x5b40f5
fld qword [esi + 0x190]
fstp qword [ebp - 0x28]
push 8
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push str.dwnlDuration
mov edx, dword [esi + 0x244]
push edx
call edi
cmp dword [ebp + 8], 0
je 0x5b4141
mov eax, dword [esi + 0x198]
test eax, eax
jle 0x5b4141
mov dword [ebp + 8], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.nSkFr1
mov ecx, dword [esi + 0x244]
push ecx
call edi
fld qword [esi + 0x1a0]
fstp qword [ebp - 0x30]
push 8
lea edx, [ebp - 0x30]
push edx
push 0
push 0
push str.dLstDrSk1
mov eax, dword [esi + 0x244]
push eax
call edi
wait
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5b4180
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x664c40
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
wait
mov ecx, dword [esi + 0xc]
fldz
fcomp qword [ecx + 0x3b8]
fnstsw ax
test ah, 1
jne 0x5b41da
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ecx + 0x334], 0
jne 0x5b41fc
mov edi, dword [esi + 0x1b8]
mov ecx, esi
call fcn.005b3e10
mov dword [esi + 0x1b0], eax
mov dword [esi + 0x1b8], edi
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [eax], 0
je 0x5b421b
push 0
push 0x146d
push 0x111
mov eax, dword [eax]
push eax
call edi
mov eax, dword [esi + 0x14]
cmp dword [eax], 0
je 0x5b4239
mov ecx, dword [esi + 0x240]
push ecx
push 0x146d
push 0x111
mov edx, dword [eax]
push edx
call edi
mov eax, dword [esi + 0x18]
cmp dword [eax], 0
je 0x5b4252
push 0
push 0x146d
push 0x111
mov eax, dword [eax]
push eax
call edi
mov eax, dword [esi + 0x244]
test eax, eax
je 0x5b42a7
push 8
mov ecx, dword [esi + 0xc]
add ecx, 0x3b8
push ecx
push 0
push 0
push str.Duration
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
mov eax, dword [esi + 0xc]
cmp dword [eax + 0x334], 0
je 0x5b42a7
mov edx, dword [eax + 0x334]
mov dword [ebp - 0x14], edx
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.nAggrV
mov ecx, dword [esi + 0x244]
push ecx
call edi
wait
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b42d0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0xf0]
or ecx, dword [eax + 0xf4]
je 0x5b4362
mov eax, dword [esi + 0x10]
cmp dword [eax], 0
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
je 0x5b4304
mov edx, dword [eax]
push 0
push 0x14a5
push 0x111
push edx
call edi
mov eax, dword [esi + 0x14]
cmp dword [eax], 0
je 0x5b4322
mov ecx, dword [esi + 0x240]
mov edx, dword [eax]
push ecx
push 0x14a5
push 0x111
push edx
call edi
mov eax, dword [esi + 0x18]
cmp dword [eax], 0
je 0x5b433b
mov eax, dword [eax]
push 0
push 0x14a5
push 0x111
push eax
call edi
mov eax, dword [esi + 0x244]
pop edi
test eax, eax
je 0x5b4362
mov ecx, dword [esi + 0xc]
push 8
add ecx, 0xf0
push ecx
push 0
push 0
push str.nExpectedSize
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret
Function at 0x5b4370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x664c60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
wait
mov eax, dword [esi + 0x244]
test eax, eax
jne 0x5b43c2
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 8
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.Duration
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5b43af
mov eax, dword [esi + 0xc]
fld qword [ebp - 0x1c]
fstp qword [eax + 0x3b8]
mov ecx, dword [esi + 0xc]
cmp dword [ecx + 0x334], 0
jne 0x5b4416
mov edi, dword [esi + 0x1b8]
mov ecx, esi
call fcn.005b3e10
mov dword [esi + 0x1b0], eax
mov dword [esi + 0x1b8], edi
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [eax], 0
je 0x5b4435
push 0
push 0x146d
push 0x111
mov edx, dword [eax]
push edx
call edi
mov eax, dword [esi + 0x14]
cmp dword [eax], 0
je 0x5b4453
mov ecx, dword [esi + 0x240]
push ecx
push 0x146d
push 0x111
mov edx, dword [eax]
push edx
call edi
mov esi, dword [esi + 0x18]
cmp dword [esi], 0
je 0x5b446c
push 0
push 0x146d
push 0x111
mov eax, dword [esi]
push eax
call edi
wait
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b4560
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x81c
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x818], eax
mov edx, dword [esp + 0x828]
mov eax, dword [esp + 0x82c]
push esi
mov esi, dword [esp + 0x828]
push edi
mov edi, dword [esp + 0x828]
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5b4643
push 0x801
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00620920
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x800
lea edx, [esp + 0x28]
push edx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5b4643
mov esi, dword [esp + 0xc]
test esi, esi
je 0x5b4643
lea eax, [esp + 0xb]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
push esi
mov ecx, edi
mov byte [esp + 0x1f], 0
mov dword [esp + 0x28], 0
call fcn.00561920
test al, al
je 0x5b4634
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.0062023e
add esp, 0x81c
ret
cmp byte [esp + 0xb], 0
je 0x5b4643
cmp esi, 0x104
ja 0x5b461b
mov ecx, dword [esp + 0x820]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.0062023e
add esp, 0x81c
ret
Function at 0x5b4b90
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x664d20
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x28]
mov dword [esp + 0x10], esi
mov dword [esi], vtable.Session.0
call fcn.00554a70
xor edi, edi
mov dword [esp + 0x230], edi
lea ecx, [esi + 0x138]
call fcn.00402510
mov ebx, 1
mov byte [esp + 0x230], bl
lea ecx, [esi + 0x18c]
call fcn.00402510
mov byte [esp + 0x230], 2
fldz
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1ac], 0x20
mov dword [esi + 0x1a8], edi
mov dword [esi + 0x178], edi
mov eax, dword [0x75de80]
mov dword [esi + 0x170], eax
mov ecx, dword [0x75de84]
fst qword [esi + 0x190]
lea edx, [esp + 0x14]
fstp qword [esi + 0x1a0]
mov dword [esi + 0x154], ebx
push edx
or ebx, 0xffffffff
push 0x202
mov dword [esi + 0x174], ecx
mov dword [esi + 0x17c], edi
mov dword [esi + 0x180], edi
mov dword [esi + 0x1c0], edi
mov dword [esi + 0x1c4], edi
mov dword [esi + 0x1d0], edi
mov dword [esi + 0x1c8], edi
mov dword [esi + 0x1cc], edi
mov dword [esi + 0x198], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x23c], edi
mov dword [esi + 0x244], edi
mov dword [esi + 0x13c], edi
mov dword [esi + 0x140], edi
mov dword [esi + 0x21c], edi
mov dword [esi + 0x220], edi
mov dword [esi + 0x224], edi
mov dword [esi + 0x1f8], edi
mov dword [esi + 0x1fc], edi
mov dword [esi + 0x228], edi
mov dword [esi + 0x230], edi
mov dword [esi + 0x234], edi
mov dword [esi + 0x238], edi
mov dword [esi + 0x1d4], edi
mov dword [esi + 0x1d8], edi
mov dword [esi + 0x208], edi
mov dword [esi + 0x20c], edi
mov dword [esi + 8], edi
mov dword [esi + 0x144], edi
mov dword [esi + 0x148], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x150], edi
mov dword [esi + 0x15c], edi
mov dword [esi + 0x160], edi
mov dword [esi + 0x164], edi
mov dword [esi + 0x168], ebx
mov dword [esi + 0x184], edi
mov dword [esi + 0x188], edi
mov dword [esi + 0x16c], edi
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x5b4d77
push 2
push 2
lea eax, [esp + 0x1ac]
push str.Cannot_find_Winsock_v_d._d_or_later__n
push eax
call fcn.0062311b
add esp, 0x10
lea ecx, [esp + 0x1a4]
push ecx
mov ecx, esi
call fcn.005b4660
mov dword [esp + 0x230], ebx
mov eax, esi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0062023e
add esp, 0x224
ret
Function at 0x5b67e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [0x75dbe4]
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
push str.bSetServerTimeToFile
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 4]
add esp, 8
ret

Function at 0x5b69e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x664fc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea edi, [esi + 0x20]
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.005cb8e0
test eax, eax
je 0x5b6a3b
push str.Not_enough_memory_during_call_to_SetDescription____n
lea ecx, [esi + 0x52c]
call fcn.0056a780
jmp 0x5b6a92
mov eax, dword [esi + 0x4f8]
test eax, eax
je 0x5b6a92
cmp dword [esi + 0x4ac], 0
jne 0x5b6a5a
push eax
mov ecx, edi
call fcn.005cee30
test al, al
je 0x5b6a99
mov edx, dword [esi + 0x60]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b6a62
sub eax, edi
cmp byte [esi + 0x362], cl
mov ecx, str.WDescription
jne 0x5b6a7d
mov ecx, 0x68aeb4
inc eax
push eax
push edx
push 1
push 0
push ecx
mov ecx, dword [esi + 0x4ac]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5b6b70
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x334], eax
mov eax, dword [esi + 0x4f8]
test eax, eax
je 0x5b6be3
cmp dword [esi + 0x4ac], 0
jne 0x5b6b9e
push eax
lea ecx, [esi + 0x20]
call fcn.005cee30
test al, al
je 0x5b6be3
mov edx, dword [esi + 0x4ac]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.categoryID
push edx
call edi
movzx eax, byte [esi + 0x36b]
mov edx, dword [esi + 0x4ac]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.CISBU
push edx
mov dword [esp + 0x20], eax
call edi
pop edi
pop esi
pop ecx
ret 4
Function at 0x5b6d60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push edi
xor edi, edi
cmp eax, edi
jne 0x5b6d8b
xor eax, eax
pop edi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0062023e
add esp, 0x10
ret
push esi
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x5b6deb
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 8
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5b6de2
cmp dword [esp + 8], 8
jne 0x5b6de2
cmp dword [esp + 0x10], 0x70797466
jne 0x5b6de2
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x14]
pop esi
pop edi
xor ecx, esp
call fcn.0062023e
add esp, 0x10
ret

Function at 0x5b71f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push esi
push 0
push 0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5b723d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b7221
sub eax, edx
je 0x5b723d
push esi
call fcn.004535e0
add esp, 4
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x5b7650
Capabilities:
Delete registry key

Disassembly:
push ebp
lea ebp, [esp - 0x84]
sub esp, 0x84
push 0xffffffffffffffff
push 0x665100
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x80], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x4ac]
cmp eax, ebx
je 0x5b76ad
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x4ac], ebx
mov eax, dword [esi + 0x4f8]
push eax
push str.SoftwareDownloadManager_ldChList
lea ecx, [ebp]
push ecx
call fcn.0062311b
add esp, 0xc
lea edx, [ebp]
push edx
push 0x80000001
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call edi
cmp dword [ebp + 0x8c], ebx
je 0x5b76e5
mov ecx, esi
call fcn.005ba400
mov eax, dword [esi + 0x4f8]
push eax
push str.SoftwareDownloadManager_ld
lea ecx, [ebp]
push ecx
call fcn.0062311b
add esp, 0xc
lea edx, [ebp]
push edx
push 0x80000001
call edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.0062023e
add ebp, 0x84
mov esp, ebp
pop ebp
ret 4