joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100587ba
push 0x57
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1005886e
push 0x1c
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.10044b80
add esp, 0xc
push 0x1c
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_VirtualQueryEx
test eax, eax
jne 0x100587e8
xor eax, eax
jmp 0x1005886e
push 0
push 0x40
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
jne 0x10058805
xor eax, eax
jmp 0x1005886e
movzx edx, word [ebp - 0x48]
cmp edx, 0x5a4d
jne 0x1005881f
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x58]
ja 0x1005881f
cmp dword [ebp - 0xc], 0x40
jae 0x1005882d
push 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1005886e
push 0
push pe_nt_image_headers32
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
jne 0x10058850
xor eax, eax
jmp 0x1005886e
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0x4550
je 0x10058869
push 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1005886e
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10044b6f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10059b20
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x234], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x10073d2c
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov dword [ebp - 0x21c], eax
cmp dword [ebp + 0xc], 1
jb 0x10059b72
cmp dword [ebp + 0xc], 0x1000
jbe 0x10059b83
push 0x57
call sub.KERNEL32.dll_SetLastError
jmp 0x10059d4b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.10059ec0
test eax, eax
jne 0x10059ba9
jmp 0x10059d4b
cmp dword [ebp - 0x21c], 0
je 0x10059bbe
cmp dword [ebp - 0x21c], 0x104
jb 0x10059bc8
jmp 0x10059d4b
push 0x10073d34
push 0x104
lea edx, [ebp - 0x218]
push edx
call fcn.10059d70
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jge 0x10059bf7
jmp 0x10059d4b
mov eax, dword [ebp - 0x234]
add eax, 0xc
push eax
push 0x10073d4c
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.10059dc0
add esp, 0x10
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jge 0x10059c33
jmp 0x10059d4b
push 0x10
push 0
lea edx, [ebp - 0x230]
push edx
call fcn.10044b80
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x280]
push eax
call fcn.10044b80
add esp, 0xc
mov dword [ebp - 0x280], 0x44
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x280]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [ebp + 0x14]
test eax, eax
je 0x10059d4b
mov edx, dword [ebp - 0x234]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
push 0x10073ce4
mov edx, dword [ebp - 0x230]
push edx
call fcn.100596c0
test eax, eax
jne 0x10059ce5
push 0xffffffffffffffff
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_CloseHandle
jmp 0x10059d4b
mov eax, dword [ebp - 0x22c]
push eax
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x284], 0x1f4
lea edx, [ebp - 0x284]
push edx
mov eax, dword [ebp - 0x230]
push eax
call sub.KERNEL32.dll_GetExitCodeProcess
mov ecx, dword [ebp - 0x230]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x284], 0
je 0x10059d41
jmp 0x10059d4b
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x234]
push eax
call fcn.1005a140
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10044b6f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1005a190
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x63c], 0
push 0x104
lea eax, [ebp - 0x418]
push eax
push str.WINDIR
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov dword [ebp - 0x41c], eax
cmp dword [ebp + 0xc], 1
jb 0x1005a1e2
cmp dword [ebp + 0xc], 0x1000
jbe 0x1005a1f3
push 0x57
call sub.KERNEL32.dll_SetLastError
jmp 0x1005a3f5
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x63c]
push ecx
call fcn.10059ec0
test eax, eax
jne 0x1005a219
jmp 0x1005a3f5
cmp dword [ebp - 0x41c], 0
je 0x1005a22e
cmp dword [ebp - 0x41c], 0x104
jb 0x1005a238
jmp 0x1005a3f5
push str._sysnative_rundll32.exe
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.1005a420
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jge 0x1005a267
jmp 0x1005a3f5
push 0x104
lea eax, [ebp - 0x628]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x63c]
add ecx, 0xc
push ecx
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jae 0x1005a29a
cmp dword [ebp - 4], 0
jg 0x1005a2a4
jmp 0x1005a3f5
lea edx, [ebp - 0x628]
push edx
push str.rundll32.exe___s__1
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.1005a480
add esp, 0x10
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jge 0x1005a2dd
jmp 0x1005a3f5
push 0x10
push 0
lea ecx, [ebp - 0x638]
push ecx
call fcn.10044b80
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x688]
push edx
call fcn.10044b80
add esp, 0xc
mov dword [ebp - 0x688], 0x44
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x688]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [ebp + 0x14]
test eax, eax
je 0x1005a3f5
mov ecx, dword [ebp - 0x63c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x63c]
push eax
push 0x10073ce4
mov ecx, dword [ebp - 0x638]
push ecx
call fcn.100596c0
test eax, eax
jne 0x1005a38f
push 0xffffffffffffffff
mov edx, dword [ebp - 0x638]
push edx
call sub.KERNEL32.dll_TerminateProcess
mov eax, dword [ebp - 0x638]
push eax
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x634]
push ecx
call sub.KERNEL32.dll_CloseHandle
jmp 0x1005a3f5
mov edx, dword [ebp - 0x634]
push edx
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov eax, dword [ebp - 0x638]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [ebp - 0x68c], 0x1f4
lea ecx, [ebp - 0x68c]
push ecx
mov edx, dword [ebp - 0x638]
push edx
call sub.KERNEL32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x638]
push eax
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x634]
push ecx
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x68c], 0
je 0x1005a3eb
jmp 0x1005a3f5
mov dword [ebp - 0x420], 1
lea edx, [ebp - 0x63c]
push edx
call fcn.1005a140
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10044b6f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1005a840
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1005a920
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1005a915
mov edx, dword [ebp - 4]
cmp edx, dword [0x10084e78]
jb 0x1005a885
mov eax, dword [ebp - 4]
cmp eax, dword [0x10084e7c]
ja 0x1005a885
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1005a855
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10044b80
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1005a8aa
jmp 0x1005a915
cmp dword [ebp - 0x10], 0x10000
jne 0x1005a8fe
cmp dword [ebp - 0x14], 0x10000
jb 0x1005a8fe
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1005a8e1
mov eax, dword [ebp - 0x24]
jmp 0x1005a917
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1005a8f1
xor eax, eax
jmp 0x1005a917
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1005a910
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.1005a920
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1005a855
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1005a950
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1005aa40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1005aa2d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10084e78]
jb 0x1005a99a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10084e7c]
ja 0x1005a99a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1005a96a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10044b80
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1005a9bf
jmp 0x1005aa2d
cmp dword [ebp - 0x10], 0x10000
jne 0x1005aa13
cmp dword [ebp - 0x14], 0x10000
jb 0x1005aa13
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1005a9f6
mov eax, dword [ebp - 0x24]
jmp 0x1005aa2f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1005aa06
xor eax, eax
jmp 0x1005aa2f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1005aa28
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.1005aa40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1005a96a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1005ad30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x102dd918]
mov dword [ebp - 4], eax
jmp 0x1005ad49
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1005ad70
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1005ad6e
call sub.KERNEL32.dll_GetLastError
jmp 0x1005ad72
jmp 0x1005ad40
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1005ad80
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x102dd928], eax
je 0x1005ad9d
mov eax, 0x10dd
jmp 0x1005ae7c
mov eax, dword [0x102dd938]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1005ae1a
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1005adf8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1005adf8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1005aee0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.10044a36
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x1005ada5
mov dword [0x102dd938], 0
call fcn.1005ae80
mov ecx, dword [0x102dd934]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x1005ae66
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10044a36
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x1005ae32
mov dword [0x102dd934], 0
mov dword [0x102dd928], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1005b3b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x1005b3c5
xor eax, eax
jmp 0x1005b43a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x1005b3f2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x1005b435
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x1005b433
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x1005b42f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x1005b433
xor eax, eax
jmp 0x1005b43a
jmp 0x1005b3e9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1005b4e0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x102dd92c], 0
je 0x1005b4f9
mov eax, dword [0x102dd92c]
jmp 0x1005b596
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1005b50a
xor eax, eax
jmp 0x1005b596
push 8
call fcn.100472c7
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1005b560
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x1005b549
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10044a36
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x102dd92c], eax
mov dword [0x102dd930], 0
mov eax, dword [ebp - 4]
jmp 0x1005b596
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1005b578
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
jmp 0x1005b52a
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x102dd934]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x102dd934], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1005be90
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1005a710
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x102dd91c], 0
jne 0x1005becd
cmp dword [0x102dd918], 0
je 0x1005becd
mov eax, dword [0x102dd918]
mov dword [0x102dd91c], eax
cmp dword [0x102dd91c], 0
je 0x1005bf4a
mov ecx, dword [0x102dd91c]
cmp dword [ecx + 8], 0
je 0x1005bf4a
mov edx, dword [0x102dd91c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x1005bf4a
mov ecx, dword [0x102dd91c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1005bf4a
mov eax, dword [0x102dd91c]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x1005bf19
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x1005bf20
xor eax, eax
jmp 0x1005c06d
mov ecx, dword [0x102dd91c]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10044b80
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x1005c06d
mov edx, dword [0x102dd918]
mov dword [0x102dd91c], edx
jmp 0x1005bf66
mov eax, dword [0x102dd91c]
mov ecx, dword [eax + 4]
mov dword [0x102dd91c], ecx
cmp dword [0x102dd91c], 0
je 0x1005bfa6
cmp dword [0x102dd91c], 0
je 0x1005bfa4
mov edx, dword [0x102dd91c]
cmp dword [edx + 8], 0
je 0x1005bfa4
mov eax, dword [0x102dd91c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x1005bfa4
mov edx, dword [0x102dd91c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1005bfa4
jmp 0x1005befe
jmp 0x1005bf58
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1005a7f0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1005c06b
mov eax, dword [ebp - 4]
mov dword [0x102dd91c], eax
mov ecx, dword [0x102dd91c]
mov dword [ecx], 0x52727464
mov edx, dword [0x102dd91c]
mov dword [edx + 8], 0
mov eax, dword [0x102dd91c]
mov ecx, dword [0x102dd918]
mov dword [eax + 4], ecx
mov edx, dword [0x102dd91c]
mov dword [0x102dd918], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x102dd91c]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x1005c037
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x1005c05b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x1005c02e
mov eax, dword [0x102dd91c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1005befe
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1005c080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x102dd928], eax
je 0x1005c0a4
mov eax, 0x10dd
jmp 0x1005c24a
cmp dword [0x102dd92c], 0
je 0x1005c0b7
mov eax, dword [0x102dd92c]
jmp 0x1005c24a
cmp dword [ebp + 0xc], 0
jne 0x1005c0c7
mov eax, 0x57
jmp 0x1005c24a
cmp dword [ebp + 8], 0
jne 0x1005c0d7
mov eax, 6
jmp 0x1005c24a
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1005c100
mov dword [ebp - 0xc], 6
mov ecx, dword [ebp - 0xc]
mov dword [0x102dd92c], ecx
mov edx, dword [ebp + 8]
mov dword [0x102dd930], edx
mov eax, dword [ebp - 0xc]
jmp 0x1005c24a
push 0x18
call fcn.100472c7
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1005c159
mov dword [ebp - 0xc], 8
mov ecx, dword [ebp - 0xc]
mov dword [0x102dd92c], ecx
cmp dword [ebp - 0x18], 0
je 0x1005c148
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.10044a36
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x102dd930], ecx
mov eax, dword [ebp - 0xc]
jmp 0x1005c24a
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1005aa70
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1005aa70
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x1005c199
cmp dword [ebp - 8], 0x1e
jbe 0x1005c1b5
mov dword [ebp - 0xc], 9
cmp dword [0x102dd920], 0
je 0x1005c1b0
jmp 0x1005c129
jmp 0x1005c120
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1005c1dc
mov dword [ebp - 0xc], 9
cmp dword [0x102dd920], 0
je 0x1005c1d7
jmp 0x1005c129
jmp 0x1005c120
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1005c207
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0xc], eax
jmp 0x1005c120
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x102dd938]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x102dd938], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40546f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
call fcn.00404de7
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
jmp 0x4054bc
push 0x4751f8
lea eax, [ebp - 0xc]
push eax
call fcn.0041bfa0
add esp, 8
jmp 0x4054d5
push 0x4751fc
lea eax, [ebp - 0xc]
push eax
call fcn.0041bfa0
add esp, 8
jmp 0x4054d5
cmp dword [ebp - 0x58], 1
je 0x40548b
cmp dword [ebp - 0x58], 2
je 0x4054a1
jmp 0x4054d5
push 0x475200
lea eax, [ebp - 0x50]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405576
cmp dword [ebp - 0x10], 2
jne 0x40555f
lea eax, [ebp - 0xc]
push eax
call fcn.0041bdf0
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40555a
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40557d
jmp 0x405576
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40557d
xor eax, eax
jmp 0x40557d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405761
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4057de
cmp dword [ebp - 8], 2
jne 0x4057ba
push 0x475210
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041bfa0
add esp, 8
xor eax, eax
jmp 0x4058f1
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10001
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x4058f1
mov dword [ebp - 8], 0xea
mov dword [ebp - 0xc], 0x80
jmp 0x4057f8
add dword [ebp - 0xc], 0x80
cmp dword [ebp - 8], 0xea
jne 0x405855
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xea
jne 0x405850
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041c424
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x4057f1
cmp dword [ebp - 8], 0
je 0x4058af
cmp dword [ebp - 8], 2
jne 0x405881
push 0x475214
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041bfa0
add esp, 8
jmp 0x4058af
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x4058f1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4058ea
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10002
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x4058f1
xor eax, eax
jmp 0x4058f1
pop edi
pop esi
pop ebx
leave
ret