joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4396b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x471413
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00463149
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004688bc
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00469e14
test eax, eax
je 0x4397cc
mov ecx, dword [esp + 0x3c]
call fcn.004688e9
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x439790
push edi
mov ecx, esi
call fcn.00465eb0
mov ecx, esi
call fcn.00439930
cmp dword [esp + 0x38], 1
jne 0x4397c5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046601a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43c200
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43c233
push esi
call fcn.0043f310
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43c22c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43c2b9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43c2a2
mov eax, dword [esi + 8]
test eax, eax
je 0x43c257
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43c29e
cmp eax, 2
je 0x43c2a2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43c24a
cmp eax, 3
je 0x43c27d
cmp eax, 1
jne 0x43c24a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43c24a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43c24a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043c2e0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43c2c8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043c2e0
add esp, 4
pop esi
ret

Function at 0x463f3f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x463f77
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00461f56
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461f2e
jmp 0x463f83
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x465639
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46567b
call fcn.0046b316
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46567b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465672
xor eax, eax
jmp 0x465683
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00465689
pop edi
pop esi
pop ebx
ret 4

Function at 0x46b846
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46b874
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46b892
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046b7ac
jmp 0x46b892
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46b892
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046b7ac
test edi, edi
mov eax, edi
jne 0x46b87c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x59454d31
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x80
lea eax, [ebp - 0x204]
push eax
push dword [edi]
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x304]
push eax
call esi
push 0x59451664
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push dword [edi + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
lea eax, [eax + eax + 0xc8]
push eax
call fcn.59451ee0
push dword [edi + 8]
mov ebx, eax
push 0x59451640
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push ebx
call esi
lea eax, [eax + eax + 2]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push 0
push dword [ebp + 8]
call ebx
cmp dword [ebp + 0xc], 0
mov eax, 0x59451624
jne 0x59454df8
mov eax, 0x59451604
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push 0x104
lea eax, [ebp - 0x50c]
push eax
push dword [0x5945c578]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x50c]
push eax
call esi
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x50c]
push eax
push 1
push 0
push 0
push dword [ebp - 4]
call ebx
cmp dword [edi + 0xc], 0
je 0x59454e58
cmp dword [edi + 0x10], 0
jne 0x59454e51
mov edi, 0x594515f8
jmp 0x59454e5d
mov edi, 0x594515ec
jmp 0x59454e5d
mov edi, 0x594515d8
push edi
call esi
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x594515b8
push dword [ebp - 4]
call ebx
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x59454e8d
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0x200]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x100]
push eax
call esi
push 0x59451664
lea eax, [ebp - 0x400]
push eax
call esi
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x400]
push eax
mov edi, 0x80000002
push edi
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jne 0x59454f2a
cmp dword [ebp + 0xc], 0
mov eax, 0x59451624
jne 0x59454f1b
mov eax, 0x594516c4
push eax
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 8]
push eax
push 0x59451694
push edi
call esi
test eax, eax
jne 0x59454f4f
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8

Function at 0x59457f19
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5945a2fc
call fcn.59455900
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov byte [ebp - 4], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi], edi
mov dword [esi + 0x14], edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x28], 1
mov dword [esi + 0x3c], edi
call fcn.59457a66
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x59458d0a
Capabilities:
Create thread

Disassembly:
mov eax, 0x5945a44a
call fcn.59455900
push ecx
push ecx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x54]
push eax
lea ecx, [ebp - 0x10]
call fcn.59453854
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x4c], edi
jne 0x59458d4d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x59458b9d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x4c], eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x59458efc
Capabilities:
Get common file path

Disassembly:
mov eax, 0x5945a46e
call fcn.59455900
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
push 0x59451aa8
lea ecx, [ebp - 0x20]
call fcn.594597ef
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ebx, 0x59451df4
push ebx
lea ecx, [ebp - 0x20]
call fcn.5945994a
cmp eax, 1
je 0x59458f87
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jg 0x59458f87
push dword [ebp - 0x10]
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [edi + eax*2 + 0xa], 0x5c
je 0x59458f7c
push 0x5945122c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
push ebx
lea ecx, [ebp - 0x20]
call fcn.5945990a
push dword [ebp - 0x10]
call fcn.59451ee5
pop ecx
jmp 0x59458fc8
push dword [ebp - 0x10]
call fcn.59451ee5
lea esi, [edi + 0xc]
mov dword [esp], 0x105
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x59458fb2
push 0x59451dec
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x59458fc8
push 0x59451dd4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
push ebx
lea ecx, [ebp - 0x20]
call fcn.5945990a
push esi
call fcn.59459bad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.59459815
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x59459058
Capabilities:
Delete file
Get file size
Move file

Disassembly:
mov eax, 0x5945a488
call fcn.59455900
sub esp, 0x1c
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.59458e15
and dword [esp + 0x2c], 0
cmp byte [esp + 0x20], 0
jne 0x59459086
or edi, 0xffffffff
jmp 0x5945922f
push ebx
or ebx, 0xffffffff
push ebp
mov edi, ebx
jmp 0x59459092
or ebx, 0xffffffff
cmp edi, ebx
jne 0x5945910b
push ebx
push dword [esi + 0x1e2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x594591e3
lea eax, [esi + 0xc]
push eax
lea edi, [esi + 0x1c20]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [esp + 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 4
push 0
push 5
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, ebx
jne 0x5945910b
push dword [esi + 0x1e2c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x594591e3
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x59459096
mov ebp, dword [esi + 0x1e2c]
mov dword [esp + 0x10], ebp
mov byte [esp + 0x34], 1
xor eax, eax
push 2
push eax
push eax
push eax
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x594591d0
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push edi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x594591ba
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, eax
jl 0x594591ba
jg 0x59459167
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x1c]
jbe 0x594591ba
lea eax, [esi + 0x1c20]
push eax
lea ebx, [esi + 0x1a16]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x59451e18
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 + 0x1a10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea eax, [esi + 0x1c20]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x594591e7
push edi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
and byte [esp + 0x34], 0
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
je 0x5945908f
jmp 0x5945922d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and byte [esp + 0x34], 0
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, ebx
jmp 0x5945922d
push 0
push 2
xor eax, eax
push eax
push dword [esp + 0x28]
call fcn.594558c0
mov ecx, dword [esp + 0x18]
cmp ecx, edx
jg 0x59459217
jl 0x59459209
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jae 0x59459217
and byte [esp + 0x34], 0
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x5945922d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and byte [esp + 0x34], 0
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
or edi, 0xffffffff
pop ebp
pop ebx
or dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.59458e52
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x59459250
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x5945a4a2
call fcn.59455900
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp byte [ebp + 8], 0x38
jb 0x59459274
and byte [ebp + 8], 0
movsx eax, byte [ebp + 8]
push dword [eax*4 + 0x5945c23c]
mov ecx, ebx
call fcn.59459058
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x594593f2
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push dword [ebx + 0x1e2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x594592c2
mov dword [ebp - 0x1c], esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.59458e02
mov eax, esi
jmp 0x594593f4
mov eax, dword [ebx + 0x1e2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
push esi
call dword [sym.imp.msvcrt.dll_time]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.msvcrt.dll_localtime]
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, esi
je 0x59459319
push eax
call dword [sym.imp.msvcrt.dll_asctime]
pop ecx
lea edx, [ebp - 0x6c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x594592fa
lea eax, [ebp - 0x6c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5945930a
sub eax, edx
and byte [ebp + eax - 0x6d], cl
jmp 0x59459324
mov esi, 0x59451e2c
lea edi, [ebp - 0x6c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x216]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x59451e20
push esi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x59459349
sub eax, edi
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp + 0x10]
push dword [ecx]
push dword [ebp + 0xc]
mov ecx, 0x7ff
sub ecx, eax
push ecx
lea eax, [eax + ebx + 0x216]
push eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
add esp, 0x10
and byte [ebx + 0xa15], 0
and dword [ebp - 0x74], 0
mov dword [ebp - 0x78], esi
lea eax, [ebx + 0xa16]
mov dword [ebp - 0x7c], eax
mov cl, byte [esi]
test cl, cl
je 0x594593b5
cmp cl, 0xa
jne 0x594593a6
mov byte [eax], 0xd
inc eax
mov dword [ebp - 0x7c], eax
inc dword [ebp - 0x74]
mov byte [eax], cl
jmp 0x594593a8
mov byte [eax], cl
inc esi
mov dword [ebp - 0x78], esi
inc eax
mov dword [ebp - 0x7c], eax
inc dword [ebp - 0x74]
jmp 0x5945938d
and byte [eax], 0
push 0
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x74]
add ebx, 0xa16
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
inc esi
mov dword [ebp - 0x84], esi
mov byte [ebp - 4], 1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x594592af
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x59459836
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebp - 0xc], 0x19
je 0x594598a4
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x594598a4
cmp dword [ebp - 8], 1
jne 0x594598a4
push 0xa
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, dword [ebp + 0xc]
add esp, 0xc
cmp dword [ebp - 4], 0
mov dword [ecx], eax
je 0x594598a4
lea eax, [ebp - 0x40]
cmp dword [ebp - 4], eax
je 0x594598a4
xor eax, eax
jmp 0x594598a7
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x594598ac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push 0x59451700
push eax
mov esi, ecx
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [esi + 4], 0
jne 0x594598d5
xor eax, eax
inc eax
jmp 0x59459905
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0xc], eax
mov eax, ecx
pop esi
leave
ret 8

Function at 0x5945990a
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea ecx, [eax + eax + 2]
mov eax, dword [esi + 4]
test eax, eax
jne 0x59459926
inc eax
jmp 0x59459946
push ecx
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0xc], eax
mov eax, ecx
pop esi
ret 8
Function at 0x5945994a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [eax], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x59459970
xor eax, eax
inc eax
jmp 0x59459a2a
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push dword [ebp + 8]
push eax
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x59459996
xor eax, eax
inc eax
jmp 0x59459a29
xor eax, eax
inc eax
cmp dword [ebp - 8], eax
je 0x594599a8
cmp dword [ebp - 8], 2
jne 0x59459a29
add dword [ebp - 4], 2
mov eax, dword [ebp - 4]
add eax, eax
push eax
call fcn.59451ee0
mov ebx, eax
test ebx, ebx
pop ecx
je 0x5945998e
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [esi + 4]
call edi
test eax, eax
mov dword [esi + 0xc], eax
jne 0x59459a02
cmp dword [ebp - 8], 2
jne 0x59459a22
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea eax, [ebp + 0xa]
push eax
push ebx
call edi
mov esi, eax
inc esi
lea eax, [esi + esi + 2]
push eax
call fcn.59451ee0
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
jne 0x59459a0b
push ebx
call fcn.59451ee5
pop ecx
jmp 0x5945998e
inc esi
push esi
push eax
push ebx
call edi
push ebx
call fcn.59451ee5
mov eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x59459a27
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x59459e7e
Capabilities:
Get common file path

Disassembly:
push ecx
push ecx
push edi
xor edi, edi
cmp dword [0x5945e414], edi
mov dword [esp + 4], edi
je 0x59459e97
xor eax, eax
inc eax
jmp 0x59459fb9
push esi
push 0x59451eac
xor esi, esi
inc esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x59459ebb
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x59459e98
cmp dword [0x5945e414], edi
jne 0x59459fac
push 0x10e
call fcn.59451ee0
mov esi, eax
cmp esi, edi
pop ecx
jne 0x59459edf
xor esi, esi
jmp 0x59459fac
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, 0x104
push ebx
push esi
call ebp
mov edi, eax
cmp edi, ebx
jbe 0x59459f15
push esi
call fcn.59451ee5
lea eax, [edi + 0xa]
push eax
call fcn.59451ee0
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x59459faa
push edi
push esi
call ebp
push 0x59451ea0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebx, ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push esi
mov edi, eax
call fcn.59451ee5
cmp edi, ebx
pop ecx
je 0x59459f9c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x59451e90
push edi
mov dword [esp + 0x18], 1
call esi
cmp eax, ebx
mov dword [0x5945e40c], eax
jne 0x59459f65
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
mov dword [esp + 0x10], ebx
push 0x59451e7c
push edi
mov dword [0x5945e418], edi
call esi
push 0x59451e68
push dword [0x5945e418]
mov dword [0x5945e408], eax
call esi
push 0x59451e54
push dword [0x5945e418]
mov dword [0x5945e410], eax
call esi
mov dword [0x5945e404], eax
mov esi, dword [esp + 0x10]
mov dword [0x5945e414], 1
pop ebp
pop ebx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ecx
pop ecx
ret