joyce8/EMBER2024-capa huggingface dataset:
Function at 0x559e72
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
call fcn.004112e5
lea eax, [ebp - 4]
push eax
call fcn.004111d5
pop ecx
pop ecx
push str.kprcycleaner.exe
lea ecx, [ebp - 4]
call fcn.00403b27
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, dword [ebp + 8]
je 0x559eb2
lea eax, [ebp - 4]
push eax
call fcn.00401e7b
jmp 0x559ebc
push 0x587f88
call fcn.0040460b
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401405
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x559f0c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
lea esi, [ecx + 0x42c]
mov eax, dword [esi + 8]
xor ebx, ebx
sub eax, dword [esi]
je 0x559f31
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
je 0x559f31
inc ebx
jmp 0x559fde
push edi
lea ecx, [ebp - 0x3c]
call fcn.00413014
push 0x3ef
call fcn.004763cd
push eax
lea eax, [ebp - 4]
push eax
call fcn.0052e609
add esp, 0xc
push dword [ebp - 4]
mov edi, 0x332
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x559f93
push 0x439
call fcn.004763cd
push eax
lea eax, [ebp - 8]
push eax
call fcn.0052e609
add esp, 0xc
push eax
lea ecx, [ebp - 4]
call fcn.00403cc2
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401405
mov edi, 0x43b
lea eax, [ebp - 4]
push eax
push edi
call fcn.004763cd
pop ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004137f4
test eax, eax
pop edi
je 0x559fcb
push esi
lea ecx, [ebp - 0x3c]
call fcn.00413812
test eax, eax
je 0x559fcb
mov eax, dword [esi + 8]
sub eax, dword [esi]
je 0x559fcb
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
je 0x559fcb
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401405
lea ecx, [ebp - 0x3c]
call fcn.00413062
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x55b260
Capabilities:
Check mutex on windows

Disassembly:
push esi
push 0x5b6ff0
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
pop esi
mov eax, ecx
ret

Function at 0x56ba4b
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56ba66
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
xor eax, eax
inc eax
pop esi
ret

Function at 0x56ba6b
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56ba8f
xor eax, eax
push eax
push eax
push eax
push dword [esi]
push str.startunpin
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc eax
pop esi
ret
Function at 0x56ba94
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56baaf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
xor eax, eax
inc eax
pop esi
ret

Function at 0x56bb2e
Capabilities:
Check if file exists
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
xor ebx, ebx
push ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [ebp + 0xc]
push dword [edi]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56bb81
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x56bb6b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x56bc24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x56bc24
lea eax, [ebp - 4]
push eax
push 0x5bbc2c
push 1
push ebx
push 0x5bbf0c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x56bb5e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0xc]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
push dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push dword [esi + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push dword [esi + 0x10]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x5bcecc
push eax
call dword [ecx]
test eax, eax
jl 0x56bc09
mov eax, dword [edi]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
xor esi, esi
inc esi
push esi
push eax
push ecx
call dword [edx + 0x18]
test eax, eax
jl 0x56bc09
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x56bc16
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x56bc23
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
leave
ret

Function at 0x56c4b8
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push edi
call fcn.004267e6
mov edi, eax
cmp edi, 7
jge 0x56c4c9
xor eax, eax
pop edi
ret
push esi
mov esi, dword [esp + 0x10]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56c504
cmp edi, 0xa
jge 0x56c4f4
xor eax, eax
push eax
push eax
push eax
push dword [esi]
push str.taskbarunpin
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x56c501
push esi
push 0x150b
call fcn.0056bc31
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
pop edi
ret
Function at 0x56c5d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5e5710]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x5e7310
mov ecx, esi
call fcn.00401c3d
and word [ebp - 0x210], 0
push 0x208
lea eax, [ebp - 0x20e]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x56c654
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
je 0x56c654
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.004020d9
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0056f17c
leave
ret

Function at 0x56c663
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call fcn.004267e6
mov edi, eax
cmp edi, 7
jge 0x56c679
xor eax, eax
pop edi
leave
ret
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56c68d
xor eax, eax
inc eax
jmp 0x56c676
lea eax, [ebp - 4]
push esi
push eax
call fcn.0056c5d0
mov esi, dword [ebp + 8]
push dword [esi]
lea eax, [ebp - 4]
push str._s.lnk
push eax
call fcn.00403d6f
lea eax, [ebp - 4]
push eax
push esi
call fcn.0056bb2e
add esp, 0x18
test eax, eax
jne 0x56c6cd
xor esi, esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401405
mov eax, esi
pop esi
jmp 0x56c676
cmp edi, 0xa
jge 0x56c6e8
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 4]
push str.taskbarpin
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x56c6f2
lea eax, [ebp - 4]
push eax
call fcn.0056c52a
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
inc esi
jmp 0x56c6bd

Function at 0x56c700
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.004267e6
cmp eax, 7
jge 0x56c712
xor eax, eax
leave
ret
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56c726
xor eax, eax
inc eax
leave
ret
push esi
lea eax, [ebp - 4]
push edi
push eax
call fcn.0056c5d0
mov esi, dword [ebp + 8]
push dword [esi]
lea eax, [ebp - 4]
push str._s.lnk
push eax
call fcn.00403d6f
lea eax, [ebp - 4]
push eax
push esi
call fcn.0056bb2e
mov esi, dword [ebp - 4]
add esp, 0x18
test eax, eax
jne 0x56c768
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.00401405
mov eax, edi
pop edi
pop esi
leave
ret
xor eax, eax
push eax
push eax
push eax
push esi
push str.startpin
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
inc edi
jmp 0x56c75a
Function at 0x56c7e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5e5710]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x210], 0
push esi
mov esi, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x20e]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
mov ecx, esi
jl 0x56c840
lea eax, [ebp - 0x210]
push eax
jmp 0x56c845
push 0x587f88
call fcn.0040460b
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0056f17c
leave
ret

Function at 0x56cde3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x56ce43
push edi
push 0x5bb2d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x56ce42
push esi
mov esi, dword [ebp + 0xc]
push 0x38
push ebx
push esi
call sub.MSVCR80.dll_memset
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 0x38
push esi
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x56ce41
push esi
call fcn.0056d489
test al, al
pop ecx
je 0x56ce41
inc ebx
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x56cecb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5e5710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
push dword [ebp + 8]
or edi, 0xffffffff
call fcn.0056ce85
test eax, eax
pop ecx
je 0x56cf8a
and word [ebp - 0x210], 0
push 0x20a
lea eax, [ebp - 0x20e]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 1
push 0x24
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x56cf8a
lea ecx, [ebp - 0x22c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
call dword [0x586418]
push str.explorer.exe
lea ecx, [ebp - 0x22c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
lea ecx, [ebp - 0x22c]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.MSVCR80.dll_swprintf_s]
mov edi, eax
add esp, 0xc
lea ecx, [ebp - 0x22c]
mov dword [esi], edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056f17c
leave
ret

Function at 0x56d3e8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], ebx
je 0x56d434
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push dword [esi + 0x34]
push dword [esi]
call edi
test eax, eax
je 0x56d433
push dword [esi + 0x34]
lea eax, [esi + 0x20]
push eax
push dword [esi]
call sub.MSVCR80.dll_memcpy
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [esi + 0x34]
push dword [esi]
call edi
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x56d489
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0x1c
push 0x5d4cd0
call fcn.0056f320
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0056d384
pop ecx
mov dword [esi + 0x34], edi
lea edi, [esi + 0x1c]
push 5
pop ebx
mov dword [edi], ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi]
add eax, dword [esi + 0x34]
push eax
call fcn.0056cc32
add esp, 0xc
test al, al
je 0x56d5eb
mov eax, dword [ebp - 0x24]
add dword [esi + 0x34], eax
mov eax, dword [esi + 0x34]
mov ecx, dword [ebp - 0x28]
add dword [edi], ecx
cmp dword [edi], 0x14
jge 0x56d5eb
cmp eax, ebx
jl 0x56d4b8
push eax
push dword [esi]
lea eax, [esi + 0x20]
push eax
call sub.MSVCR80.dll_memcpy
lea ebx, [esi + 8]
push 0x14
push edi
push ebx
push dword [esi + 0x34]
push dword [esi]
call fcn.0056ccab
add esp, 0x20
test al, al
je 0x56d5eb
mov eax, dword [esi]
cmp byte [eax], 0xe9
jne 0x56d544
mov ecx, dword [eax + 1]
lea eax, [ecx + eax + 5]
lea ecx, [esi + 0xd]
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov byte [ebx], 0xe9
push 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 9]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [edi]
sub eax, ecx
sub eax, esi
sub eax, 8
mov dword [ebp - 0x1c], eax
mov byte [ecx + esi + 8], 0xe9
push 4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [edi]
lea eax, [eax + esi + 9]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
add dword [edi], 5
lea eax, [ebp - 0x20]
push eax
push 0x40
push dword [esi + 0x34]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
test eax, eax
je 0x56d5d5
and dword [ebp - 4], 0
mov eax, dword [esi]
mov byte [eax], 0xe9
mov eax, dword [esi + 4]
mov ecx, dword [esi]
sub eax, ecx
sub eax, 5
mov dword [ebp - 0x1c], eax
push 4
lea eax, [ebp - 0x1c]
push eax
inc ecx
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push 5
pop eax
mov dword [ebp - 0x2c], eax
cmp eax, dword [esi + 0x34]
jge 0x56d5c0
mov ecx, dword [esi]
mov byte [eax + ecx], 0x90
inc eax
jmp 0x56d5af
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push dword [esi + 0x34]
push dword [esi]
call edi
mov dword [ebp - 4], 0xfffffffe
mov al, 1
call fcn.0056f365
ret
xor al, al
jmp 0x56d5d7
Function at 0x56e4f8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5e5710]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0056e357
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x56e547
cmp dword [ebp - 0x1c], 5
jb 0x56e55f
jmp 0x56e55b
cmp dword [ebp - 0x10], 1
jne 0x56e55f
cmp dword [ebp - 0x1c], 4
ja 0x56e55b
jne 0x56e55f
cmp dword [ebp - 0x18], 0
jbe 0x56e55f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x5be97c
call fcn.00421006
test eax, eax
jge 0x56e580
mov byte [0x5e582c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0056f17c
add ebp, 0x78
leave
ret

Function at 0x56e9b8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x5e732c], 0
push esi
jne 0x56e926
call fcn.0056e844
test eax, eax
je 0x56e969
mov eax, dword [0x5e732c]
cmp eax, 1
jne 0x56e947
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x56e969
pop esi
ret
push eax
call dword [0x5e7334]
test eax, eax
jne 0x56e9b1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x56e96d
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x5e732c]
call dword [0x5e7334]
mov edi, eax
test edi, edi
je 0x56e994
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x56e9b0
lea edi, [esi + 0xff0]
push esi
push dword [0x5e732c]
call dword [0x5e7330]
add esi, 0x10
cmp esi, edi
jb 0x56e99a
mov eax, esi
pop edi
pop esi
ret
jmp 0x56e913

Function at 0x56f17c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5e5710]
jne 0x56f186
repz ret
jmp fcn.0056fd78

Function at 0x577960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5819a7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e5710]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], vtable.Json::StyledWriter.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [esi + 0x4c], 0x4a
mov dword [esi + 0x50], 3
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40cced
Capabilities:
Get disk information

Disassembly:
push 0x124
mov eax, 0x493606
call fcn.004521d2
mov ebx, ecx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x11c], ebx
xor eax, eax
mov edi, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x12c], eax
stosd dword es:[edi], eax
push ecx
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00414097
and dword [ebp - 4], 0
lea eax, [ebp - 0xe8]
xor edi, edi
push eax
inc edi
push 0x68
mov dword [ebp - 0x12c], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40ce05
cmp word [ebp - 0xe8], 0
lea esi, [ebp - 0xe8]
je 0x40ce05
push esi
lea ecx, [ebp - 0x100]
call fcn.00409baa
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x100]
cmp dword [ebp - 0xec], 8
mov eax, dword [ebp - 0xf0]
cmovae ecx, dword [ebp - 0x100]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x100]
cmovae ecx, dword [ebp - 0x100]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x118]
call fcn.0040a437
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 0
je 0x40cddd
sub eax, 1
je 0x40cddd
sub eax, 1
je 0x40cdcf
sub eax, 1
je 0x40cdcf
sub eax, 1
je 0x40cdcf
sub eax, 1
jmp 0x40cddd
lea eax, [ebp - 0x118]
mov ecx, ebx
push eax
call fcn.00414061
lea ecx, [ebp - 0x118]
call fcn.004085da
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0
call fcn.0040848e
add esi, 8
xor eax, eax
cmp word [esi], ax
jne 0x40cd5f
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
mov dword [ebp - 0x124], esi
cmp esi, edi
jae 0x40ce9d
lea eax, [esi + 0x18]
mov dword [ebp - 0x120], eax
mov edx, 0x4af88d
mov dword [ebp - 0x11c], edi
mov ecx, esi
call fcn.0040cb3e
test al, al
je 0x40ce81
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x11c], eax
cmp eax, edi
je 0x40ce70
mov dword [ebp - 0x128], esi
mov ebx, eax
sub esi, eax
push ebx
lea ecx, [esi + ebx]
call fcn.004140fb
add ebx, 0x18
cmp ebx, edi
jne 0x40ce51
mov ebx, dword [ebp - 0x130]
mov esi, dword [ebp - 0x124]
mov edi, dword [ebx + 4]
lea ecx, [edi - 0x18]
call fcn.004085da
add dword [ebx + 4], 0xffffffe8
mov eax, dword [ebx + 4]
jmp 0x40ce87
mov eax, dword [ebp - 0x11c]
add dword [ebp - 0x120], 0x18
add esi, 0x18
mov dword [ebp - 0x124], esi
mov edi, eax
cmp esi, eax
jb 0x40ce21
mov eax, ebx
call fcn.0045217c
ret
Function at 0x41172f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x14
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
push esi
lea esi, [eax*2 + 2]
jb 0x41174b
mov edx, dword [edx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x411756
mov eax, dword [eax]
push esi
push edx
push 1
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41176e
pop esi
leave
ret 8
push str.Cannot_write_string_value:_RegSetValueExW_failed.
push eax
lea ecx, [ebp - 0x14]
call fcn.0041184e
push 0x4c3aec
lea eax, [ebp - 0x14]
push eax
call fcn.004688b1
int3

Function at 0x41178b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0x494499
call fcn.004521d2
mov ebx, ecx
mov esi, dword [ebp + 0xc]
xor edx, edx
mov edi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x14], edx
jb 0x4117b7
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push edx
push edx
push 2
push eax
push edx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x411831
mov eax, dword [ebp - 0x14]
mov ecx, edi
push 0x20
shr eax, 1
push eax
call fcn.00405a35
xor edx, edx
mov eax, edi
mov dword [ebp - 4], edx
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x18], 1
jb 0x4117f2
mov eax, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x4117fa
mov esi, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
push edx
push 2
push esi
push edx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x411817
push str.Cannot_get_string_value:_RegGetValueW_failed.
jmp 0x411836
mov ecx, dword [ebp - 0x14]
shr ecx, 1
dec ecx
push 0
push ecx
mov ecx, edi
call fcn.004140d8
mov eax, edi
call fcn.0045217c
ret 8
push str.Cannot_get_size_of_string_value:_RegGetValueW_failed.
push eax
lea ecx, [ebp - 0x30]
call fcn.0041184e
push 0x4c3aec
lea eax, [ebp - 0x30]
push eax
call fcn.004688b1
int3
Function at 0x43ba20
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497938
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4c5114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x43ba96
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x43ba96
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x43bab4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045112d
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.00405bd5
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.0043bb80
push 0x4c0578
lea eax, [ebp - 0x50]
push eax
call fcn.004688b1
int3