joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5024a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x5024e1
cmp dword [ebp + 0xc], 0
je 0x5024e1
cmp dword [ebp + 0x10], 0
je 0x5024e1
cmp dword [ebp + 0x14], 0
jne 0x5024e6
jmp 0x5025b9
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.005019d0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5025b9
cmp dword [ebp - 0x14], 0
je 0x5025b9
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5025b9
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call fcn.0049b535
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5025b9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5025b9
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x50258f
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x5025a4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00501a80
add esp, 8
mov dword [ebp - 4], eax
jmp 0x5025b9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
cmp dword [ebp - 8], 0
je 0x5025d2
mov eax, dword [ebp - 8]
push eax
call fcn.00509e30
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x5025eb
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00509e30
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x502660
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x50269a
cmp dword [ebp + 0xc], 0
je 0x50269a
cmp dword [ebp + 0x14], 0
je 0x50269a
cmp dword [ebp + 0x18], 0
jne 0x50269f
jmp 0x502721
cmp dword [ebp + 0x10], 1
je 0x5026ab
cmp dword [ebp + 0x10], 2
jne 0x502702
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005016e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5026c6
jmp 0x502721
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.005016e0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5026e1
jmp 0x502721
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
jmp 0x502721
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x50273a
mov edx, dword [ebp - 4]
push edx
call fcn.00509e30
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x502753
mov eax, dword [ebp - 8]
push eax
call fcn.00509e30
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x502760
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x50279a
cmp dword [ebp + 0xc], 0
je 0x50279a
cmp dword [ebp + 0x14], 0
je 0x50279a
cmp dword [ebp + 0x18], 0
jne 0x50279f
jmp 0x502829
cmp dword [ebp + 0x10], 1
je 0x5027ab
cmp dword [ebp + 0x10], 2
jne 0x50280a
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005019d0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5027c6
jmp 0x502829
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.005019d0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5027e1
jmp 0x502829
mov ecx, dword [ebp - 0x10]
shl ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
jmp 0x502829
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x502842
mov eax, dword [ebp - 8]
push eax
call fcn.00509e30
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x50285b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00509e30
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x5028c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x5028fa
cmp dword [ebp + 8], 0
jne 0x5028fa
jmp 0x50299a
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [ebp - 8], 0
je 0x50299a
mov edx, dword [ebp - 8]
push edx
call fcn.0049b535
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x50299a
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x50299a
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00501be0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x50299a
cmp dword [ebp + 0xc], 0
je 0x502994
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jle 0x50296e
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049d100
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049d180
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], 0
je 0x5029b3
mov eax, dword [ebp - 0xc]
push eax
call fcn.00509e30
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x5029cc
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00509e30
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5029e0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x502a1a
cmp dword [ebp + 8], 0
jne 0x502a1a
jmp 0x502abc
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebp - 8], 0
je 0x502abc
mov edx, dword [ebp - 8]
shl edx, 1
push edx
call fcn.0049b535
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x502abc
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x502abc
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00501a80
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x502abc
cmp dword [ebp + 0xc], 0
je 0x502ab6
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jle 0x502a90
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049d100
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049d180
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 0
je 0x502ad5
mov eax, dword [ebp - 4]
push eax
call fcn.00509e30
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x502aee
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00509e30
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x502c10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005016e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x502d06
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x502d06
cmp dword [ebp + 0x10], 0
je 0x502d06
mov eax, dword [ebp - 0xc]
push eax
call fcn.0049b535
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x502d06
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x502d06
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00501be0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x502ced
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jle 0x502cce
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0049b230
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x502d06
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0049d100
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x502d1f
mov edx, dword [ebp - 8]
push edx
call fcn.00509e30
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x502d38
mov eax, dword [ebp - 4]
push eax
call fcn.00509e30
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x502d51
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00509e30
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x502d60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005019d0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x502e58
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x502e58
cmp dword [ebp + 0x10], 0
je 0x502e58
mov eax, dword [ebp - 8]
shl eax, 1
push eax
call fcn.0049b535
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x502e58
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x502e58
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00501a80
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x502e3f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jle 0x502e20
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0049b230
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov byte [edx], 0
jmp 0x502e58
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0049d100
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x502e71
mov edx, dword [ebp - 0x10]
push edx
call fcn.00509e30
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 4], 0
je 0x502e8a
mov eax, dword [ebp - 4]
push eax
call fcn.00509e30
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x502ea3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00509e30
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x504d10
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x5dca44]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40c], 0
push 0x400
lea eax, [ebp - 0x408]
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x504d57
lea ecx, [ebp - 0x408]
push ecx
call fcn.00505170
add esp, 4
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049c81f
mov esp, ebp
pop ebp
ret

Function at 0x505170
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5dca44]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 1
call fcn.00505d70
add esp, 4
test eax, eax
jne 0x5051b5
mov eax, dword [ebp - 0xc]
jmp 0x505296
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005016e0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5051e0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x41c], edx
jmp 0x5051e9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
push ecx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x505211
mov edx, dword [ebp - 8]
push edx
call fcn.0049b3e3
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0x14], 0
jne 0x50521c
mov eax, dword [ebp - 0xc]
jmp 0x505296
push 0x400
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x14]
movsx edx, word [ecx + 8]
push edx
call fcn.00505440
add esp, 0x10
test eax, eax
jne 0x50524a
mov eax, dword [ebp - 0xc]
jmp 0x505296
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
movsx edx, word [ecx + 8]
push edx
call fcn.00505c20
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
movsx ecx, word [eax + 8]
push ecx
mov edx, dword [ebp - 0x14]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00505d20
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0049c81f
mov esp, ebp
pop ebp
ret

Function at 0x505d70
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x5dca44]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5e4c40], 0
je 0x505d93
mov eax, 1
jmp 0x505dd1
mov word [ebp - 0x19c], 0x101
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x19c]
push ecx
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x505dc2
call sub.WS2_32.dll_WSAGetLastError
call sub.WS2_32.dll_WSACleanup
xor eax, eax
jmp 0x505dd1
mov dword [0x5e4c40], 1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049c81f
mov esp, ebp
pop ebp
ret
Function at 0x511590
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
push eax
call fcn.00512bd0
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00512a40
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x51168a
push 0
call fcn.00511720
add esp, 4
push 1
call fcn.00511720
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x51168a
mov eax, dword [ebp - 0x10]
push eax
call fcn.00509e30
add esp, 4
cmp dword [ebp + 8], 0
je 0x511680
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x80], 0
je 0x51164f
xor edx, edx
je 0x51164f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x14], ecx
jmp 0x511656
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f3810
add esp, 0x1c
mov eax, 1
jmp 0x511714
mov edx, dword [ebp - 0x10]
push edx
call fcn.00509e30
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x5116b2
cmp dword [ebp + 0x14], 0
jne 0x5116c2
mov eax, dword [ebp + 0x10]
push eax
call fcn.0049fd40
add esp, 4
test eax, eax
jne 0x5116c2
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x511708
cmp dword [ebp + 0x14], 0
je 0x5116d0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x5116e2
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0049fd40
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
xor ecx, ecx
cmp dword [ebp + 0x14], 0
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00502600
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x512bd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5dca44]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x512bf0
mov eax, connect
jmp 0x512c3c
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.0049d100
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x512c37
cmp dword [ebp + 8], 0
jne 0x512c37
cmp dword [ebp - 0x9c], 6
jb 0x512c37
mov eax, connect
jmp 0x512c3c
mov eax, getsockname
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049c81f
mov esp, ebp
pop ebp
ret
Function at 0x5194d0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x5dca44]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x410], 0
push 0x3ff
push 0
lea eax, [ebp - 0x40f]
push eax
call fcn.0049d100
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x818], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x817]
push ecx
call fcn.0049d100
add esp, 0xc
mov dword [ebp - 0x414], 0x400
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x50]
push eax
push 0x5c62f4
lea ecx, [ebp - 0x410]
push ecx
call fcn.0049cf34
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
push 0x20007
push 0
push 0x5c6300
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x5195dc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x80], 0
je 0x519597
xor ecx, ecx
je 0x519597
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x80]
mov dword [ebp - 0x81c], eax
jmp 0x5195a1
mov dword [ebp - 0x81c], 0xffffff86
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x81c]
mov dword [ecx + 0x80], edx
push 0
push 0xff
push 0
push 0
push 0x267
push 0xffffffffffffff86
mov eax, dword [ebp + 8]
push eax
call fcn.004f3810
add esp, 0x1c
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x80]
jmp 0x5196d4
mov edx, dword [ebp - 8]
mov dword [ebp - 0x820], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x818]
push ecx
mov edx, dword [ebp - 0x820]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
test eax, eax
jne 0x5196c8
mov edx, dword [ebp - 0x414]
mov byte [ebp + edx - 0x818], 0
push 0x2d
lea eax, [ebp - 0x818]
push eax
call fcn.0049a9f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5196b9
lea ecx, [ebp - 0x410]
push ecx
call fcn.0049fd40
add esp, 4
push eax
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x818]
push eax
call fcn.0049d9d9
add esp, 0xc
test eax, eax
jne 0x5196b9
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
mov edx, dword [ebp - 4]
add edx, 1
push edx
call fcn.0049fe50
add esp, 8
test eax, eax
jne 0x5196b9
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.LM_BORROW
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005196f0
add esp, 8
mov dword [ebp - 0x414], 0x400
jmp 0x5195dc
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049c81f
mov esp, ebp
pop ebp
ret
Function at 0x52af00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x52af14
mov eax, dword [ebp + 0x10]
mov dword [0x62d8f8], eax
jmp 0x52af1e
mov dword [0x62d8f8], 0xffffffff
mov ecx, dword [ebp + 0x14]
mov dword [0x62d8ec], ecx
cmp dword [0x5e64c0], 0
je 0x52af3f
mov edx, dword [0x62d8dc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x52afb0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x62d8dc], eax
cmp dword [0x62d8dc], 0
jne 0x52af5f
xor eax, eax
jmp 0x52afb5
push 4
push 1
call fcn.004a00ea
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52af78
xor eax, eax
jmp 0x52afb5
mov eax, dword [ebp - 4]
mov ecx, dword [0x62d8dc]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x52ae70
call fcn.004a427e
add esp, 0xc
mov dword [0x5e64c0], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x5e64c0], 0
jne 0x52afb0
xor eax, eax
jmp 0x52afb5
mov eax, dword [0x5e64c0]
mov esp, ebp
pop ebp
ret

Function at 0x52aff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.0049f044
add esp, 4
mov dword [0x5e60b0], eax
cmp dword [0x5e60b0], 0
je 0x52b017
mov eax, dword [0x5e60b0]
jmp 0x52b092
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push str.SOFTWAREFLEXlm_License_Manager
push getsockname
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52b090
mov dword [ebp - 0xc], 0x400
lea edx, [ebp - 0xc]
push edx
push 0x5e60b8
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52b082
mov dword [0x5e60b0], 0x5e60b8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x5e60b0]
jmp 0x52b092
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x52b092
xor eax, eax
mov esp, ebp
pop ebp
ret