joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461c80
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jge 0x461cc1
push 0xc3
push str.....Srcopenssl_1.1.1ncrypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.0043fb00
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x465440
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x465475
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
dec ecx
mov byte [esi], al
shr eax, 8
test ecx, ecx
jne 0x465460
pop ebx
pop edi
pop esi
ret

Function at 0x4913b0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.005530f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.00459080
mov ebx, eax
push ebx
push esi
call fcn.004591f0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x49143c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x491416
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x491409
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.00459260
push esi
call fcn.00458f20
mov edi, eax
add esp, 0x10
test edi, edi
jbe 0x49143c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.00459080
mov ebx, eax
push ebx
push esi
call fcn.004591f0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4914ae
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x491494
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x491487
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.00459260
push esi
call fcn.00458f20
add esp, 0x10
mov edi, eax
test edi, edi
ja 0x491434
push esi
call fcn.00458f20
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x495ba9
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x495c1f
test eax, eax
je 0x495beb
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.0045acd0
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x495beb
push 0x3b
push str.....Srcopenssl_1.1.1ncryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.0043fb00
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x495c1b
cmp edi, 0x40a
je 0x495c12
cmp edi, 0x43f
je 0x495c12
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x495c17
mov eax, 0x20
cmp esi, eax
je 0x495c1f
push 0x41
jmp 0x495bd0
push ebx
push 0x46
push str.....Srcopenssl_1.1.1ncryptoececx_meth.c
push 0x40
call fcn.00450100
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x495c55
push 0x48
push str.....Srcopenssl_1.1.1ncryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.0043fb00
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x495c6d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call fcn.00552ae0
add esp, 0xc
jmp case.0x495d9e.1036
cmp edi, 0x40a
je 0x495c8d
cmp edi, 0x43f
je 0x495c8d
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x495c92
mov eax, 0x20
push 0x50
push str.....Srcopenssl_1.1.1ncryptoececx_meth.c
push eax
call fcn.004577d0
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x495cc5
push 0x52
push str.....Srcopenssl_1.1.1ncryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.0043fb00
add esp, 0x14
jmp 0x495d18
cmp ebp, 2
jne 0x495d58
cmp edi, 0x40a
je 0x495cee
cmp edi, 0x43f
je 0x495cee
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x495cf3
mov eax, 0x20
push eax
push esi
call fcn.00459960
add esp, 8
test eax, eax
jg 0x495d2e
push 0x57
push str.....Srcopenssl_1.1.1ncryptoececx_meth.c
push esi
call fcn.004577f0
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push str.....Srcopenssl_1.1.1ncryptoececx_meth.c
push ebx
call fcn.00450170
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x495d47
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x495d8c
cmp edi, 0x40b
jne 0x495d8c
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x495d8c
cmp edi, 0x40a
je 0x495d78
cmp edi, 0x43f
je 0x495d78
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x495d7d
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.00552ae0
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x495d9e.1036
movzx ecx, byte [eax + 0x495df8]
jmp dword [ecx*4 + 0x495de4]
push esi
push ebx
call fcn.004fc2e0
jmp 0x495dc7
push esi
push ebx
call fcn.004fc210
jmp 0x495dc7
push esi
push ebx
call fcn.004eec50
jmp 0x495dc7
push esi
push ebx
call fcn.004eca50
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.0045b980
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x4a2330
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x4a5bf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.005530f0
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.00453d30
add esp, 8
test eax, eax
jne 0x4a5c2b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x4a5c8d
xor ebx, ebx
test ebp, ebp
jle 0x4a5df0
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x4a5c6f
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x4a5c48
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x4a5c40
jmp 0x4a5df0
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
cmp dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jle 0x4a5df0
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
cmp edi, esi
mov dword [esp + 0x20], esi
jle 0x4a5dcc
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x4a5d60
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
jl 0x4a5d30
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x4ecf10
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
push ebp
lea ecx, [ebx + 0xc]
push esi
lea eax, [edx + 4]
sub ebx, edx
mov ebp, 4
mov esi, dword [eax - 4]
mov edx, dword [ecx - 0xc]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax - 4], esi
xor dword [ecx - 0xc], edx
mov esi, dword [eax]
mov edx, dword [ebx + eax]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax], esi
xor dword [ebx + eax], edx
mov esi, dword [eax + 4]
mov edx, dword [ecx - 4]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 4], esi
xor dword [ecx - 4], edx
mov esi, dword [eax + 8]
mov edx, dword [ecx]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 8], esi
xor dword [ecx], edx
add eax, 0x10
add ecx, 0x10
sub ebp, 1
jne 0x4ecf22
pop esi
pop ebp
pop ebx
ret
Function at 0x4fc210
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.005530f0
mov eax, dword [0x5f8320]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xec]
push esi
mov esi, dword [esp + 0xec]
push edi
lea ecx, [esp + 0xa8]
push ecx
push 0x20
push eax
call fcn.004a3330
mov dl, byte [esp + 0xd3]
and byte [esp + 0xb4], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esp + 0xd3], dl
lea ecx, [esp + 0xb4]
lea edx, [esp + 0x14]
call fcn.004f3a90
lea edi, [esp + 0x14]
call fcn.004f2d20
lea eax, [esp + 0xb4]
push 0x40
push eax
call fcn.00462100
mov ecx, dword [esp + 0xfc]
add esp, 0x14
pop edi
pop esi
xor ecx, esp
call fcn.0055189a
add esp, 0xe4
ret
Function at 0x4fc2e0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x140
call fcn.005530f0
mov eax, dword [0x5f8320]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x154]
push edi
mov ecx, 8
lea edi, [esp + 0x12c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x148]
and byte [esp + 0x12c], 0xf8
shr ecx, 0x18
and cl, 0x3f
or cl, 0x40
mov byte [esp + 0x14b], cl
lea ecx, [esp + 0x12c]
lea edx, [esp + 0x64]
mov dword [esp + 0x10], eax
call fcn.004f3a90
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb8]
mov esi, dword [esp + 0x94]
mov edi, dword [esp + 0x98]
mov ebx, dword [esp + 0x9c]
add edx, eax
sub eax, dword [esp + 0x8c]
mov ebp, dword [esp + 0xa0]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x90]
add edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0xbc]
add esi, edx
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0xc0]
add edi, esi
sub ecx, dword [esp + 0x90]
sub edx, dword [esp + 0x94]
sub esi, dword [esp + 0x98]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0xc4]
add ebx, edi
sub edi, dword [esp + 0x9c]
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0xc8]
add ebx, ebp
mov ebp, dword [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xc8]
sub eax, dword [esp + 0xa0]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0xcc]
add ebx, ebp
mov ebp, dword [esp + 0xa8]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0xcc]
sub eax, dword [esp + 0xa4]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0xd0]
add ebx, ebp
mov ebp, dword [esp + 0xac]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xd0]
sub eax, dword [esp + 0xa8]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0xd4]
add ebx, ebp
mov ebp, dword [esp + 0xb0]
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0xd8]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xd4]
add ebp, ebx
sub eax, dword [esp + 0xac]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x5c], eax
sub ebx, dword [esp + 0xb0]
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x64], ebx
call fcn.004f1840
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edx
call fcn.004ef5c0
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
call fcn.004ef1f0
lea ecx, [esp + 0x13c]
push 0x20
push ecx
call fcn.00462100
mov ecx, dword [esp + 0x164]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055189a
add esp, 0x140
ret
Function at 0x514790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x5c
call fcn.005530f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x74]
push edi
xor edi, edi
push 0x38
lea eax, [esp + 0x38]
push edi
push eax
mov dword [esp + 0x3c], edi
call fcn.00551820
lea ecx, [esp + 0x3c]
sub ecx, esi
mov dword [esp + 0x20], ecx
xor eax, eax
lea ecx, [esp + 0x40]
add esp, 0xc
sub ecx, esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
jmp 0x5147e4
mov esi, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + eax*4]
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x18], 7
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ebp
push ecx
push 0
push eax
call fcn.005584f0
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + esi]
xor ebp, ebp
add eax, ecx
mov ecx, dword [esp + 0x10]
push ebp
adc edx, ebp
add edi, eax
mov eax, dword [esi + 4]
push ecx
adc ebx, edx
mov edx, dword [esp + 0x1c]
push ebp
push eax
mov dword [edx + esi], edi
call fcn.005584f0
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + esi]
xor ebx, ebx
add eax, edi
adc edx, ebx
mov dword [ecx + esi], eax
add esi, 8
sub dword [esp + 0x18], 1
mov edi, edx
jne 0x514800
mov ebp, dword [esp + 0x30]
imul ebp, ebp, 0xae918bc5
mov dword [esp + 0x68], edi
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], ebp
xor eax, eax
jmp 0x514878
mov eax, dword [esp + 0x2c]
mov edx, dword [esi*4 + 0x5d4d5c]
push eax
push ebp
push 0
push edx
call fcn.005584f0
mov ecx, dword [esp + esi*4 + 0x30]
xor ebp, ebp
add eax, ecx
adc edx, ebp
add ebx, eax
adc edi, edx
test esi, esi
je 0x51489f
mov dword [esp + esi*4 + 0x2c], ebx
mov ebp, dword [esp + 0x10]
mov edx, dword [esi*4 + 0x5d4d60]
xor eax, eax
push eax
push ebp
push eax
push edx
mov dword [esp + 0x3c], eax
call fcn.005584f0
mov ecx, dword [esp + esi*4 + 0x34]
xor ebx, ebx
add eax, ecx
adc edx, ebx
xor ecx, ecx
add eax, edi
adc edx, ecx
lea ecx, [esi + 1]
test ecx, ecx
je 0x5148d4
mov dword [esp + esi*4 + 0x30], eax
add esi, 2
xor edi, edi
mov ebx, edx
cmp esi, 0xe
jb 0x514874
mov edx, dword [esp + esi*4 + 0x30]
xor eax, eax
lea esi, [esp + esi*4 + 0x30]
xor ecx, ecx
add edx, dword [esp + 0x1c]
adc eax, ecx
add ebx, edx
adc edi, eax
mov eax, dword [esp + 0x20]
inc eax
mov dword [esi - 4], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
cmp eax, 0xe
jb 0x5147e0
mov eax, dword [esp + 0x70]
push edi
push 0x5d4d5c
lea edx, [esp + 0x38]
push edx
push eax
mov edx, 0x5d4d5c
call fcn.00514670
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x527789
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x589447
call fcn.0055d68d
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004036b0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x5277eb
call fcn.005225d6
cmp eax, 1
jne 0x5277eb
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x5dd758
push eax
call fcn.005257f2
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403440
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402060
mov dword [ebp + 8], reloc.WS2_32.dll_accept
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402060
mov eax, esi
call fcn.0055d765
ret 0x10

Function at 0x527814
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x589472
call fcn.0055d68d
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004036b0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x527876
call fcn.005225d6
cmp eax, 1
jne 0x527876
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x5dd758
push eax
call fcn.005257f2
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403440
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402060
mov dword [ebp + 8], reloc.WS2_32.dll_accept
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402060
mov eax, esi
call fcn.0055d765
ret 0x14

Function at 0x5278a2
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x58949d
call fcn.0055d68d
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004036b0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x527904
call fcn.005225d6
cmp eax, 1
jne 0x527904
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x5dd758
push eax
call fcn.005257f2
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403440
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402060
mov dword [ebp + 8], reloc.WS2_32.dll_accept
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402060
mov eax, esi
call fcn.0055d765
ret 8
Function at 0x5378b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x5378fb
call fcn.005231c7
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x5378fb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x537917
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0053742c
mov esi, eax
test edi, edi
je 0x537915
test ebx, ebx
je 0x537915
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x538421
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58a45d
call fcn.0055d68d
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x538446
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x53848c
lea ecx, [ebp - 0x10]
call fcn.00402460
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0051e474
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402060
mov eax, esi
call fcn.0055d765
ret 8

Function at 0x54370f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x543733
cmp dword [edi + 0x54], 0
jne 0x543733
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.005231c7
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.005436d0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x55189a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5f8320]
jne 0x5518a4
repz ret
jmp fcn.0056001a
Function at 0x559501
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x559532
call fcn.0055aa88
mov dword [eax], esi
call fcn.0055aa75
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00561d28
add esp, 0x14
push 0x16
pop eax
jmp 0x559587
test dword [ebp + 0xc], 0xfffffff9
jne 0x55950e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x55955f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0055aa9b
pop ecx
call fcn.0055aa75
mov eax, dword [eax]
jmp 0x559587
test al, 0x10
jne 0x559585
test al, 1
je 0x559585
test byte [ebp + 0xc], 2
je 0x559585
call fcn.0055aa88
mov dword [eax], 5
call fcn.0055aa75
mov dword [eax], 0xd
jmp 0x559556
xor eax, eax
pop esi
pop ebp
ret
Function at 0x575e41
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0055f3e5
and dword [ebp - 4], 0
cmp dword [0x5ff0b4], 0
mov ebx, eax
jne 0x575ef2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x575fa3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x575fa3
push eax
call fcn.0055f373
mov dword [esp], 0x5e4cbc
push edi
mov dword [0x5ff0b4], eax
call esi
push eax
call fcn.0055f373
mov dword [esp], 0x5e4ca8
push edi
mov dword [0x5ff0b8], eax
call esi
push eax
call fcn.0055f373
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5ff0bc], eax
call esi
push eax
call fcn.0055f373
pop ecx
mov dword [0x5ff0c4], eax
test eax, eax
je 0x575ef2
push 0x5e4c74
push edi
call esi
push eax
call fcn.0055f373
pop ecx
mov dword [0x5ff0c0], eax
mov eax, dword [0x5ff0c0]
cmp eax, ebx
je 0x575f4a
cmp dword [0x5ff0c4], ebx
je 0x575f4a
push eax
call fcn.0055f3ee
push dword [0x5ff0c4]
mov esi, eax
call fcn.0055f3ee
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x575f4a
test edi, edi
je 0x575f4a
call esi
test eax, eax
je 0x575f41
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x575f41
test byte [ebp - 0xc], 1
jne 0x575f4a
or dword [ebp + 0x10], 0x200000
jmp 0x575f83
mov eax, dword [0x5ff0b8]
cmp eax, ebx
je 0x575f83
push eax
call fcn.0055f3ee
pop ecx
test eax, eax
je 0x575f83
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x575f83
mov eax, dword [0x5ff0bc]
cmp eax, ebx
je 0x575f83
push eax
call fcn.0055f3ee
pop ecx
test eax, eax
je 0x575f83
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5ff0b4]
call fcn.0055f3ee
pop ecx
test eax, eax
je 0x575fa3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x575fa5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret