joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0c40
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push dword [ebp + 8]
call fcn.004f5460
add esp, 0x18
cmp dword [ebp + 0x10], 0
jne 0x4d0c7d
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push dword [ebp + 8]
call fcn.004f5460
add esp, 0x10
pop edi
pop ebp
ret

Function at 0x4d2d30
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 8], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov dword [ebp - 4], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x4d2d6e
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + ebx*4 - 8]
push esi
call fcn.004d31a0
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x4d2e2f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
call fcn.00491fa0
push edi
call fcn.00492a70
add esp, 0x14
cmp eax, 0x65
jne 0x4d2dc2
mov edx, dword [ebp + 0x10]
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [ebp + 0x14]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ecx
push edx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.004d2c50
add esp, 0x1c
jmp 0x4d2e1d
cmp eax, 0x64
jne 0x4d2e1d
push 0
push edi
call fcn.00492ee0
mov ecx, eax
add esp, 8
mov eax, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x18]
cmp ecx, edx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
jne 0x4d2dea
cmp eax, ecx
je 0x4d2e1d
push ecx
mov ecx, dword [ebp + 0x14]
test ebx, ebx
push edx
mov edx, dword [ebp + 0x10]
mov eax, str.__rowid
push ecx
push edx
mov dword [ebp + 8], str.__parent
cmove eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push ecx
push edx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.004d2c50
add esp, 0x2c
push edi
call fcn.00493a60
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x4d2e2f
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x4e7f3a
push ebx
push esi
nop dword [eax]
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4e7f1a
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x59a028]
movzx ecx, al
movzx ecx, byte [ecx + 0x59a028]
sub ecx, edx
jne 0x4e7f01
sub ebx, esi
nop
test al, al
je 0x4e7f16
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x59a028]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x59a028]
sub ecx, edx
je 0x4e7ee0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x4e7ea0
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x4e7f01
mov eax, dword [ebp - 8]
push 0
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.004af9c0
add esp, 0xc
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x4e7f0d
jmp 0x4e7f04
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4e7f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
nop
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], eax
jle 0x4e801d
mov ebx, eax
xor ebx, 1
cmp eax, 2
cmovge ebx, eax
test edi, edi
je 0x4e7fe0
mov eax, dword [edx + 0x10]
mov ecx, ebx
add ecx, ecx
mov esi, edi
mov edx, dword [eax + ecx*8]
mov al, byte [edi]
movzx ecx, al
movzx edi, byte [ecx + 0x59a028]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x59a028]
sub edi, ecx
jne 0x4e8004
sub edx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
nop dword [eax]
test al, al
je 0x4e7fd6
movzx ecx, byte [edx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x59a028]
mov al, byte [esi]
movzx ecx, al
movzx edi, byte [ecx + 0x59a028]
sub edi, edx
mov edx, dword [ebp - 8]
je 0x4e7fb0
jmp 0x4e8004
test edi, edi
jne 0x4e8004
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
shl ebx, 4
push 0
push ecx
mov eax, dword [ebx + eax + 0xc]
add eax, 8
push eax
call fcn.004af9c0
add esp, 0xc
mov eax, dword [eax + 8]
test eax, eax
jne 0x4e80cd
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
inc eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
cmp eax, dword [edx + 0x14]
jl 0x4e7f71
mov dl, byte [ecx]
movzx eax, dl
cmp byte [eax + 0x59a028], 0x73
jne 0x4e80cb
mov esi, str.sqlite_master
sub esi, ecx
test dl, dl
je 0x4e805f
movzx eax, byte [esi + ecx + 1]
inc ecx
mov dword [ebp + 0xc], ecx
mov dl, byte [ecx]
movzx ecx, byte [eax + 0x59a028]
movzx eax, dl
movzx eax, byte [eax + 0x59a028]
sub eax, ecx
jne 0x4e80cb
mov ecx, dword [ebp + 0xc]
jmp 0x4e8036
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x10]
test edi, edi
jne 0x4e8075
neg edx
sbb edx, edx
jmp 0x4e80ba
test edx, edx
je 0x4e80cb
movzx eax, byte [edx]
mov esi, edi
mov bl, byte [edi]
movzx ecx, byte [eax + 0x59a028]
movzx eax, bl
movzx eax, byte [eax + 0x59a028]
sub eax, ecx
jne 0x4e80b8
sub edx, edi
test bl, bl
je 0x4e80b8
movzx eax, byte [edx + esi + 1]
inc esi
movzx ecx, byte [eax + 0x59a028]
mov bl, byte [esi]
movzx eax, bl
movzx eax, byte [eax + 0x59a028]
sub eax, ecx
je 0x4e8097
mov edx, eax
test edx, edx
jne 0x4e80cb
mov ecx, str.sqlite_temp_master
mov dword [ebp + 0xc], ecx
jmp 0x4e7f60
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f73d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test byte [ecx + 0x1c], 4
mov edx, dword [ecx + 0x14]
je 0x4f73fa
mov eax, dword [edx + 0x18]
cmp eax, dword [ecx + 0x18]
jb 0x4f73fa
cmp dword [edx + 0x60], 0
je 0x4f73f6
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00518de0
xor eax, eax
pop ebp
ret
mov eax, dword [edx + 0x28]
test eax, eax
jne 0x4f73f8
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x4f7418
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.004caaa0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.004cbd60
Function at 0x51d4f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x14
mov dword [edi], 0
call fcn.004f4e10
mov esi, eax
add esp, 8
test esi, esi
jne 0x51d517
pop edi
lea eax, [esi + 7]
pop esi
pop ebp
ret
cmp dword [0x5cabc4], 0
push ebx
mov ebx, dword [ebp + 0x10]
je 0x51d562
mov eax, dword [0x5cacc4]
test eax, eax
je 0x51d53b
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x51d562
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x501a50
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.00557de1
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x51d56f
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x51d588
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x52cee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f2ab
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push ebx
push esi
push edi
mov eax, dword [0x5c9440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x14]
push 0x20000
push 0
push esi
call fcn.005497a0
add esp, 0xc
lea eax, [ebx + 0x20014]
push 0
push eax
push 0x20000
push esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x52d0a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x52d064
cmp eax, 0xffffffff
je 0x52d064
call fcn.0043b940
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x52d064
cmp dword [ebx + 0x2005c], 8
lea eax, [ebx + 0x20048]
mov dword [ebp - 0x14], eax
jb 0x52cf95
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
call fcn.00406f40
push 3
push 0x58a9c0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.00406f40
mov byte [ebp - 4], 1
call fcn.0043b940
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x7b
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00403fb0
mov esi, eax
push str.RecvData_failed__error_code_:
push esi
mov byte [ebp - 4], 2
call fcn.00405020
add esp, 8
mov ecx, esi
push dword [ebp - 0x10]
call fcn.00404e80
push str.__channel_name:
push esi
call fcn.00405020
mov ecx, dword [ebp - 0x14]
mov eax, str._null_
test ecx, ecx
cmovne eax, ecx
push eax
push esi
call fcn.00402e40
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.004052b0
lea ecx, [ebp - 0x2c]
call fcn.00404a30
lea ecx, [ebp - 0x44]
call fcn.00404a30
mov esi, dword [ebp - 0x10]
mov dword [ebx + 0xc], 6
cmp esi, 0xe8
je 0x52d085
cmp esi, 0xe9
je 0x52d085
cmp esi, 0x6d
je 0x52d085
cmp esi, 6
jne 0x52d0db
mov dword [ebx + 0xc], 7
mov dword [ebx + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
mov dword [ecx + 4], eax
mov dword [edi + 0x10], 0
mov eax, dword [ebx + 0x20014]
test eax, eax
je 0x52d0d4
test esi, esi
je 0x52d0d4
push dword [ebp - 0x10]
add eax, esi
push eax
push esi
push dword [ecx + 4]
call fcn.00413e80
mov dword [edi + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52e740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x52e807
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x52e755
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x52ff00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587ec3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x5c9440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x5cf468]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.0052fe50
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x5300e1
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.005497a0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x5a6480
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5300e1
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x52ffd5
cmp eax, 2
jne 0x5300e1
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x52fff6
test cl, 1
jne 0x5300e1
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x52fffc
jmp 0x5300e1
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x5300e1
call fcn.0040b090
mov ecx, eax
test ecx, ecx
je 0x53010c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.0052e2e0
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x5a6488
push eax
call fcn.005304a0
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.0052e740
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x5300c5
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x530066
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.00410130
push dword [0x5cf470]
lea eax, [ebp - 0x74]
push dword [0x5cf46c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x5300a2
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5300be
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x5300e3
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5300e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x5300ee
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045db8e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040a9f0
int3
Function at 0x5301a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5c9440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x5cf468]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.0052fe50
test eax, eax
je 0x5302c8
mov esi, dword [ebp - 0x18]
mov edi, dword [0x5cf468]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x530273
cmp dword [esi], 0
je 0x530266
push 0x5a6334
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x530233
mov eax, 1
jmp 0x530294
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x53026c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x530294
cmp dword [esi + 4], 0
jne 0x530273
mov eax, 1
jmp 0x530294
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x5302be
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x5302a6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x5302cb
xor ebx, ebx
jmp 0x53036f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x53036f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x530328
mov ecx, dword [ebx]
test ecx, ecx
je 0x53038e
push ecx
push eax
call fcn.005640a9
add esp, 8
test eax, eax
je 0x530328
mov edx, dword [edi]
test edx, edx
je 0x530328
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x530300
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x530333
lea eax, [edx + 0xd]
jmp 0x530368
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x530340
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x5a6480
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x53037a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040a9f0
int3
Function at 0x531990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x531a01
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x5319cf
cmp eax, 2
jne 0x5319eb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x5319fb
test ecx, ecx
je 0x5319f6
test cl, 1
jne 0x5319eb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x5319fb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x534825
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x55f1fd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0045ddb0
mov eax, dword [0x5c9440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00568896
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x55f23f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x55f39b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0045dcc0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5d69f8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0055d76a
mov ecx, dword [esi*4 + 0x5d69f8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x55f394
cmp eax, dword [ecx + edi + 0x24]
jne 0x55f394
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x55f394
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0055d76a
add esp, 0x14
test edx, edx
jl 0x55f394
jg 0x55f30a
test eax, eax
jb 0x55f394
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x55f394
jl 0x55f324
cmp dword [ebp - 0x1008], eax
ja 0x55f394
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x55f342
test ebx, ebx
je 0x55f37b
cmp ecx, edi
jae 0x55f37b
mov al, byte [ecx]
cmp al, 0xd
jne 0x55f35c
lea eax, [edi - 1]
cmp ecx, eax
jae 0x55f368
cmp byte [ecx + 1], 0xa
jne 0x55f368
inc ecx
jmp 0x55f368
movzx eax, al
movsx eax, byte [eax + 0x5cf948]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x55f342
cmp edx, ebx
jne 0x55f342
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x55f399
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0045db8e
leave
ret

Function at 0x56527f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5652be
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5652be
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5652be
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5652be
cmp dword [ecx + 0x74], 0xe
jbe 0x5652be
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x56ac2b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5aa8a8
push 0x5aa8a0
push 0x58ec48
push 0x1f
call fcn.0056aa56
mov esi, eax
add esp, 0x10
test esi, esi
je 0x56ac5f
push dword [ebp + 8]
mov ecx, esi
call dword [0x58a4c4]
call esi
jmp 0x56ac65
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x56aca9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5aa8b8
push 0x5aa8b0
push str.FlsGetValue
push 0x21
call fcn.0056aa56
mov esi, eax
add esp, 0x10
test esi, esi
je 0x56ace0
push dword [ebp + 8]
mov ecx, esi
call dword [0x58a4c4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x56ace8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5aa8c0
push 0x5aa8b8
push str.FlsSetValue
push 0x22
call fcn.0056aa56
mov esi, eax
add esp, 0x10
test esi, esi
je 0x56ad22
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x58a4c4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]