joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500307
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x56e7a6
call fcn.0053c1d0
sub esp, 0x420
mov eax, dword [0x5af710]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push ebx
push edi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x428], eax
xor ebx, ebx
push 0x572aed
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], 2
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x424], 0x400
mov dword [ebp - 0x420], ebx
call fcn.004071e0
mov edi, dword [ebp + 8]
cmp dword [edi - 0xc], ebx
mov byte [ebp - 4], 3
je 0x500438
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], ebx
je 0x500438
lea eax, [ebp - 0x41c]
push eax
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x42c], esp
mov ecx, esp
push eax
call fcn.0040b190
mov ecx, dword [ebp - 0x414]
call fcn.004ffc57
cmp eax, ebx
mov dword [ebp - 0x414], eax
je 0x500438
push 0x400
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.0053c340
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push ebx
push dword [ebp - 0x41c]
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x500438
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x500426
mov ecx, dword [ebp - 0x428]
lea eax, [ebp - 0x410]
push eax
call fcn.00404600
mov dword [ebp - 0x420], 1
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x41c]
add ecx, 0xfffffff0
call fcn.00401250
lea ecx, [edi - 0x10]
call fcn.00401250
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00401250
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret 0x10
Function at 0x50427e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ecx, ecx
cmp dword [ebp + 8], ecx
push esi
push edi
je 0x504337
mov eax, dword [ebp + 0xc]
cmp eax, ecx
je 0x504337
cmp byte [eax], cl
je 0x504337
mov ebx, dword [ebp + 0x10]
cmp ebx, ecx
je 0x504337
cmp byte [ebx], cl
je 0x504337
cmp dword [ebp + 0x18], ecx
je 0x504337
mov esi, dword [ebp + 0x1c]
cmp esi, ecx
je 0x504337
lea edx, [ebp + 8]
push edx
push 0x20019
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x504337
mov edi, dword [ebp + 0x14]
mov eax, dword [esi]
push esi
push dword [ebp + 0x18]
mov dword [ebp - 4], eax
push edi
push 0
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x504337
test edi, edi
je 0x504333
mov edi, dword [edi]
cmp edi, 1
je 0x504312
cmp edi, 7
jne 0x504333
mov ecx, dword [esi]
xor eax, eax
dec ecx
je 0x504333
cmp eax, dword [ebp - 4]
jae 0x504333
mov ecx, dword [ebp + 0x18]
add ecx, eax
cmp byte [ecx], 0
jne 0x50432b
mov byte [ecx], 0x20
mov ecx, dword [esi]
inc eax
dec ecx
cmp eax, ecx
jb 0x504319
mov al, 1
jmp 0x504339
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x504c45
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x56ed3b
call fcn.0053c1d0
sub esp, 0x4a0
mov eax, dword [0x5af710]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
xor esi, esi
push str.SOFTWAREMicrosoftInternet_Explorer
lea ecx, [ebp - 0x464]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x48c], esi
call fcn.00405500
cmp dword [ebp - 0x44c], 0x10
mov eax, dword [ebp - 0x460]
mov dword [ebp - 4], esi
jae 0x504c9a
lea eax, [ebp - 0x460]
lea ecx, [ebp - 0x490]
push ecx
push 0xf003f
push esi
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x504cd8
push 0x572aed
mov ecx, edi
call fcn.00405500
push esi
push 1
lea ecx, [ebp - 0x464]
call fcn.00402c50
mov eax, edi
jmp 0x504e8d
push str.Version
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x48c], 0x400
call fcn.00405500
cmp dword [ebp - 0x468], 0x10
mov eax, dword [ebp - 0x47c]
jae 0x504d07
lea eax, [ebp - 0x47c]
push ebx
lea ecx, [ebp - 0x48c]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push esi
push esi
push eax
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x490]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x430], 0xf
call fcn.004023c0
xor edi, edi
inc edi
cmp ebx, esi
mov byte [ebp - 4], 2
jne 0x504e4d
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00405500
push edi
push esi
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 3
mov byte [ebp - 0x484], 0x2e
call fcn.0040b695
cmp eax, esi
jl 0x504de7
lea ebx, [eax + 1]
push ebx
push esi
lea eax, [ebp - 0x4ac]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00405540
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 4
call fcn.00404360
push esi
push edi
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 3
call fcn.00402c50
push edi
push ebx
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 0x484], 0x2e
call fcn.0040b695
cmp eax, esi
jge 0x504e06
mov ecx, dword [ebp - 0x488]
push 0x572aed
call fcn.00405500
push esi
push edi
lea ecx, [ebp - 0x42c]
call fcn.00402c50
jmp 0x504e5f
sub eax, ebx
push eax
push ebx
lea eax, [ebp - 0x4ac]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00405540
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 5
call fcn.00406c30
push esi
push edi
lea ecx, [ebp - 0x4ac]
call fcn.00402c50
push esi
push edi
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 2
call fcn.00402c50
mov ecx, dword [ebp - 0x488]
lea eax, [ebp - 0x448]
push eax
call fcn.00404830
push esi
lea ecx, [ebp - 0x448]
push edi
call fcn.00402c50
push esi
lea ecx, [ebp - 0x480]
push edi
call fcn.00402c50
push esi
lea ecx, [ebp - 0x464]
push edi
call fcn.00402c50
mov eax, dword [ebp - 0x488]
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.0053aaae
leave
ret
Function at 0x505205
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x56ee13
call fcn.0053c1d0
sub esp, 0x83c
mov eax, dword [0x5af710]
mov ecx, dword [ebp + 0x10]
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x834], ebx
je 0x505414
cmp byte [eax], bl
je 0x505414
lea eax, [ebp - 0x834]
push eax
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, ebx
je 0x505275
push ebx
jmp 0x505419
push edi
push ebx
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x814], 0xf
call fcn.004023c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x83c], ebx
mov esi, 0x400
push esi
lea eax, [ebp - 0x810]
push ebx
push eax
mov dword [ebp - 0x830], esi
call fcn.0053c340
add esp, 0xc
push dword [ebp - 0x830]
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x83c]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, ebx
jne 0x5053df
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x5053d4
push esi
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x830], 0x3ff
call fcn.0053c340
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
push str.NetCfgInstanceId
push dword [ebp - 0x838]
call edi
test eax, eax
jne 0x5053c8
push dword [ebp - 0x848]
lea eax, [ebp - 0x410]
push eax
call fcn.0053dba0
test eax, eax
pop ecx
pop ecx
jne 0x5053c8
push esi
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x830], 0x3ff
call fcn.0053c340
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
push str.DriverDesc
push dword [ebp - 0x838]
call edi
test eax, eax
jne 0x5053c8
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00404af0
mov ecx, dword [ebp - 0x840]
push str.4D36E972_E325_11CE_BFC1_08002bE10318_
call fcn.00404af0
mov ecx, dword [ebp - 0x840]
lea eax, [ebp - 0x810]
push eax
call fcn.0040b8bf
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x83c]
jmp 0x5052a0
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x844]
lea eax, [ebp - 0x82c]
push eax
call fcn.00404830
push ebx
push 1
lea ecx, [ebp - 0x82c]
call fcn.00402c50
mov eax, dword [ebp - 0x844]
pop edi
jmp 0x505422
push 0x572aed
mov ecx, esi
call fcn.00405500
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret
Function at 0x505528
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 2
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x505570
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0050543a
test al, al
pop ecx
pop ecx
je 0x50556c
lea eax, [ebp - 4]
push eax
push 2
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x505570
xor al, al
jmp 0x505597
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
leave
ret
Function at 0x505cf8
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x56ee13
call fcn.0053c1d0
sub esp, 0x834
mov eax, dword [0x5af710]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
xor edi, edi
mov dword [ebp - 0x830], edi
push edi
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x814], 0xf
call fcn.004023c0
lea eax, [ebp - 0x830]
push eax
push ebx
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x505e87
mov esi, 0x400
push esi
lea eax, [ebp - 0x810]
push edi
push eax
mov dword [ebp - 0x834], esi
call fcn.0053c340
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push str.ClassGUID
push dword [ebp - 0x830]
call ebx
test eax, eax
jne 0x505e7b
lea eax, [ebp - 0x810]
push str.4D36E972_E325_11CE_BFC1_08002bE10318
push eax
call fcn.005470ba
test eax, eax
pop ecx
pop ecx
jne 0x505e7b
push esi
lea eax, [ebp - 0x410]
push edi
push eax
mov dword [ebp - 0x834], esi
call fcn.0053c340
add esp, 0xc
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x410]
push eax
push edi
push edi
push str.DeviceDesc
push dword [ebp - 0x830]
call ebx
test eax, eax
jne 0x505e7b
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call fcn.005058da
test eax, eax
pop ecx
pop ecx
je 0x505e7b
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00404af0
push esi
lea eax, [ebp - 0x410]
push edi
push eax
mov dword [ebp - 0x834], esi
call fcn.0053c340
add esp, 0xc
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x410]
push eax
push edi
push edi
push 0x575738
push dword [ebp - 0x830]
call ebx
test eax, eax
jne 0x505e7b
mov ecx, dword [ebp - 0x840]
lea eax, [ebp - 0x410]
push eax
call fcn.00404af0
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x838]
lea eax, [ebp - 0x82c]
push eax
call fcn.00404830
push edi
push 1
lea ecx, [ebp - 0x82c]
call fcn.00402c50
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x838]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret
Function at 0x505ec6
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x56ee33
call fcn.0053c1d0
sub esp, 0x858
mov eax, dword [0x5af710]
mov ecx, dword [ebp + 0x10]
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x848], ecx
mov dword [ebp - 0x830], ebx
je 0x50609f
cmp byte [eax], bl
je 0x50609f
push ebx
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x814], 0xf
call fcn.004023c0
lea eax, [ebp - 0x834]
push eax
push str.EnumPCI
push reloc.WSOCK32.dll_bind
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x506081
push edi
mov esi, 0x400
push esi
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x830], ebx
call fcn.0053c340
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push esi
lea eax, [ebp - 0x410]
push eax
push ebx
jmp 0x50605e
inc dword [ebp - 0x830]
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x506048
push esi
lea eax, [ebp - 0x810]
push ebx
push eax
mov dword [ebp - 0x83c], ebx
call fcn.0053c340
add esp, 0xc
push esi
lea eax, [ebp - 0x810]
push eax
push ebx
jmp 0x506030
push dword [ebp - 0x848]
inc dword [ebp - 0x83c]
push dword [ebp - 0x840]
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x838]
lea eax, [ebp - 0x864]
push eax
call fcn.00505cf8
add esp, 0x14
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], 1
call fcn.00404360
push ebx
push 1
lea ecx, [ebp - 0x864]
mov byte [ebp - 4], bl
call fcn.00402c50
cmp dword [ebp - 0x818], ebx
jne 0x50603c
push esi
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x83c]
push dword [ebp - 0x838]
call edi
test eax, eax
je 0x505fc8
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x818], ebx
jne 0x50606e
push esi
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x830]
push dword [ebp - 0x834]
call edi
test eax, eax
je 0x505f7e
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x844]
pop edi
lea eax, [ebp - 0x82c]
push eax
mov ecx, esi
call fcn.00404830
push ebx
push 1
lea ecx, [ebp - 0x82c]
call fcn.00402c50
jmp 0x5060ab
push 0x572aed
mov ecx, esi
call fcn.00405500
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret
Function at 0x50b8e9
Capabilities:
Delete file

Disassembly:
mov eax, 0x56eee2
call fcn.0053c1d0
sub esp, 0xbc
mov eax, dword [0x5af710]
xor eax, ebp
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x30], eax
je 0x50b880
cmp byte [esi], bl
je 0x50b880
push 1
push 0x1b6
push 1
push esi
lea ecx, [ebp - 0xc8]
call fcn.0042b7c3
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0xc0]
test al, 6
mov dword [ebp - 4], ebx
je 0x50b7e0
xor esi, esi
jmp 0x50b861
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004023c0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.0042b3db
cmp eax, ebx
pop ecx
pop ecx
jne 0x50b80e
xor ecx, ecx
jmp 0x50b815
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
neg al
sbb eax, eax
not eax
test ecx, eax
je 0x50b83c
lea eax, [ebp - 0x2c]
push eax
call fcn.00504435
pop ecx
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040b07e
jmp 0x50b7f4
lea ecx, [ebp - 0xc8]
call fcn.0042b8aa
cmp dword [ebp + 0x10], ebx
je 0x50b853
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402c50
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.0042b864
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], 0x572840
call fcn.0054dfcb
mov eax, esi
jmp 0x50b882
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret
jmp 0x50b776

Function at 0x50c0de
Capabilities:
Terminate process

Disassembly:
push esi
push dword [esp + 8]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x50c119
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
test ebx, ebx
je 0x50c116
cmp dword [esp + 0x10], 0
je 0x50c116
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, ebx
pop ebx
pop esi
ret 8
Function at 0x50c24d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x828]
sub esp, 0x8a8
mov eax, dword [0x5af710]
push ebx
xor eax, ebp
push esi
mov esi, dword [ebp + 0x834]
mov dword [ebp + 0x824], eax
mov eax, dword [ebp + 0x838]
push edi
mov edi, dword [ebp + 0x830]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
je 0x50c386
mov byte [eax], bl
lea eax, [ebp - 0x18]
push eax
push 0x18
lea eax, [ebp - 0x38]
push eax
push ebx
push edi
mov dword [ebp - 0x18], ebx
call dword [ecx + 0x14]
test eax, eax
jne 0x50c386
mov eax, dword [ebp - 0x34]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x50c386
push ebx
push 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add eax, 8
push eax
push edi
call esi
test eax, eax
je 0x50c386
push ebx
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
je 0x50c386
mov eax, dword [ebp - 0x10]
push ebx
push 4
lea ecx, [ebp - 0xc]
add eax, 0x14
push ecx
push eax
push edi
mov dword [ebp - 8], eax
call esi
test eax, eax
je 0x50c386
mov eax, dword [ebp - 0xc]
jmp 0x50c331
push ebx
push 0x48
lea ecx, [ebp - 0x80]
push ecx
add eax, 0xfffffff8
push eax
push edi
call esi
test eax, eax
je 0x50c386
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ecx]
je 0x50c338
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 8]
jne 0x50c30f
jmp 0x50c386
movzx eax, word [ebp - 0x5a]
mov ecx, dword [ebp + 0x83c]
cmp ecx, eax
mov dword [ebp - 8], eax
jae 0x50c34c
mov dword [ebp - 8], ecx
mov edx, 0x104
xor eax, eax
mov ecx, edx
push ebx
push dword [ebp - 8]
mov word [ebp + 0x410], bx
lea edi, [ebp + 0x412]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 4], bx
lea edi, [ebp - 2]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x410]
push eax
push dword [ebp - 0x58]
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x50c38d
xor eax, eax
jmp 0x50c42c
cmp word [ebp + 0x410], 0x5c
lea esi, [ebp + 0x410]
jne 0x50c413
push 4
mov eax, esi
push 0x57ec80
push eax
call fcn.0054ea76
add esp, 0xc
test eax, eax
jne 0x50c3bb
lea esi, [ebp + 0x418]
jmp 0x50c413
push 0xc
lea eax, [ebp + 0x410]
push str.SystemRoot_
push eax
call fcn.0054ea76
add esp, 0xc
test eax, eax
jne 0x50c413
push 0x104
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
jbe 0x50c413
add eax, eax
cmp word [ebp + eax - 6], 0x5c
je 0x50c3fe
mov word [ebp + eax - 4], 0x5c
mov word [ebp + eax - 2], bx
lea eax, [ebp + 0x428]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0053aabc
pop ecx
pop ecx
lea esi, [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x83c]
push dword [ebp - 0x20]
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x824]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aaae
add ebp, 0x828
leave
ret 0x10
Function at 0x50cc70
Capabilities:
Access peb ldr_data
Enumerate pe sections
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x56f548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
push 0x2e
lea ecx, [esp + 0x1c]
call fcn.0050f8e0
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
push 1
push 0x2e
push eax
mov ecx, edi
mov dword [esp + 0x34], 0
call fcn.005107b0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov dx, word [eax + 4]
mov word [esi + 8], dx
mov cx, word [eax + 6]
mov word [esi + 0xa], cx
mov dx, word [eax + 8]
mov word [esi + 0xc], dx
mov cx, word [eax + 0xa]
mov word [esi + 0xe], cx
mov dx, word [eax + 0xc]
mov word [esi + 0x10], dx
mov cx, word [eax + 0xe]
mov word [esi + 0x12], cx
mov edx, dword [eax + 0x10]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x1c], edx
mov cx, word [eax + 0x20]
mov dx, word [eax + 0x22]
mov bx, word [eax + 0x1c]
mov bp, word [eax + 0x1e]
mov word [esi + 0x20], dx
mov word [esp + 0x30], cx
mov cx, word [eax + 0x24]
mov word [esi + 0x22], cx
mov edx, dword [eax + 0x26]
mov dword [esi + 0x24], edx
mov eax, dword [eax + 0x2a]
lea ecx, [esp + 0x14]
mov dword [esi + 0x28], eax
call fcn.0050f720
mov edx, dword [esi + 4]
mov ecx, 0x5ae4ec
cmp edx, dword [ecx]
je 0x50cd6c
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.0050f910
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
mov eax, dword [edi + 0x50]
movzx ebx, bx
push 0
push ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], eax
call fcn.0050f750
mov eax, dword [esi + 0x3c]
push 1
push ebx
push eax
mov ecx, edi
call fcn.005107b0
test bp, bp
je 0x50cdb0
movzx ebx, bp
push 0
push ebx
lea ecx, [esi + 0x2c]
call fcn.0050f750
mov eax, dword [esi + 0x30]
push 1
push ebx
push eax
mov ecx, edi
call fcn.005107b0
mov eax, dword [esp + 0x30]
test ax, ax
je 0x50cdd5
movzx ebx, ax
push 0
push ebx
lea ecx, [esi + 0x44]
call fcn.0050f750
mov esi, dword [esi + 0x48]
push 1
push ebx
push esi
mov ecx, edi
call fcn.005107b0
mov ecx, dword [esp + 0x10]
cmp dword [edi + 0x50], ecx
lea ecx, [esp + 0x14]
sete bl
mov dword [esp + 0x28], 0xffffffff
call fcn.0050f910
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4

Function at 0x50d7e0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0xfc]
test byte [eax + 0xc], 1
je 0x50d838
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test ebp, ebp
jbe 0x50d836
jmp 0x50d800
mov ecx, dword [edi + 0x1a0]
mov eax, dword [edi + 0x7c]
and ecx, 0xfffd
or ecx, 2
mov edx, ecx
xor edx, 1
imul edx, ecx
mov cl, byte [eax + esi]
add eax, esi
sar edx, 8
xor cl, dl
mov byte [eax], cl
movsx eax, cl
push eax
mov ecx, edi
call fcn.0050d760
inc esi
cmp esi, ebp
jb 0x50d800
pop esi
pop ebp
pop edi
ret 4
Function at 0x50dad0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x56f618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
push esi
mov edi, ecx
push 0xc
lea ecx, [esp + 0x18]
call fcn.0050f8e0
mov eax, dword [esp + 0x14]
push esi
push 0xc
push eax
lea ecx, [edi + 0x84]
mov dword [esp + 0x30], esi
call fcn.005107b0
mov eax, dword [edi + 0x1a0]
mov ecx, dword [esp + 0x14]
mov dl, byte [ecx + esi]
and eax, 0xfffd
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor bl, dl
mov byte [esp + 0xc], bl
mov edx, dword [esp + 0xc]
push edx
mov ecx, edi
call fcn.0050d760
inc esi
cmp esi, 0xc
jl 0x50db12
mov edi, dword [edi + 0xfc]
mov al, byte [edi + 0xc]
shr al, 3
test al, 1
je 0x50db5f
mov al, byte [edi + 0x11]
jmp 0x50db62
mov al, byte [edi + 0x17]
cmp al, bl
lea ecx, [esp + 0x10]
sete bl
mov dword [esp + 0x24], 0xffffffff
call fcn.0050f910
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret