joyce8/EMBER2024-capa huggingface dataset:
Function at 0x518af0
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push ebp
push 0x518c79
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, 2
call fcn.0051877c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x518c5b
xor eax, eax
push ebp
push 0x518c54
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x22c
call fcn.00403a4c
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.0051879c
mov ebx, eax
jmp 0x518c35
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call fcn.00406c08
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00471bc4
mov edx, dword [ebp - 0x244]
mov eax, 0x518c94
call fcn.00470308
test al, al
je 0x518c25
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x238]
push eax
call sub.Kernel32.dll_ProcessIdToSessionId
test eax, eax
je 0x518c25
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x60afcc]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x518c25
xor eax, eax
push ebp
push 0x518c1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x518c07
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.00405308
call fcn.00405308
jmp 0x518c5b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518c25
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.005187bc
mov ebx, eax
test ebx, ebx
jne 0x518b73
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518c5b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518c80
lea eax, [ebp - 0x248]
mov edx, 2
call fcn.00406a00
ret
Function at 0x518c25
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push ebp
push 0x518c79
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, 2
call fcn.0051877c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x518c5b
xor eax, eax
push ebp
push 0x518c54
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x22c
call fcn.00403a4c
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.0051879c
mov ebx, eax
jmp 0x518c35
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call fcn.00406c08
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00471bc4
mov edx, dword [ebp - 0x244]
mov eax, 0x518c94
call fcn.00470308
test al, al
je 0x518c25
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x238]
push eax
call sub.Kernel32.dll_ProcessIdToSessionId
test eax, eax
je 0x518c25
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x60afcc]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x518c25
xor eax, eax
push ebp
push 0x518c1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x518c07
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.00405308
call fcn.00405308
jmp 0x518c5b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518c25
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.005187bc
mov ebx, eax
test ebx, ebx
jne 0x518b73
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518c5b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518c80
lea eax, [ebp - 0x248]
mov edx, 2
call fcn.00406a00
ret

Function at 0x518cb0
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x60afd0], 0
je 0x518cca
call dword [0x60afd0]
mov dword [ebp - 4], eax
jmp 0x518ccf
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x518d3d
cmp dword [ebp - 4], 0xffffffff
je 0x518d3d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x60afcc]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x518d38
xor eax, eax
push ebp
push 0x518d31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x518d15
call fcn.00405308
jmp 0x518d51
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518d3d
mov eax, dword [ebp - 8]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x518d49
cmp dword [ebp - 4], 0xffffffff
jne 0x518d51
call fcn.00518af0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x51921c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
mov eax, dword [ebp - 8]
call fcn.004069f0
xor eax, eax
push ebp
push 0x5193bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor edx, edx
push ebp
push 0x51938a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x68]
call fcn.0051a584
mov edx, dword [ebp - 0x68]
mov eax, 0x5193dc
call fcn.00518f78
mov esi, eax
test esi, esi
jne 0x5192b3
lea eax, [ebp - 0x70]
call fcn.0051882c
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
mov edx, 0x519404
call fcn.00406edc
mov eax, dword [ebp - 0x6c]
call fcn.00518804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519394
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a4c
mov dword [ebp - 0x54], 0x44
mov eax, 0x519434
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x24], 0
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x10]
push eax
call sub.userenv.dll_CreateEnvironmentBlock
cmp eax, 1
sbb eax, eax
inc eax
test al, al
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x400
push 0
push 0
push 0
push 0x519460
push dword [ebp - 4]
push 0x519470
push dword [ebp - 8]
lea eax, [ebp - 0x74]
mov edx, 4
call fcn.00406fc0
mov eax, dword [ebp - 0x74]
call fcn.00406a94
push eax
push 0
push esi
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x10]
push eax
call sub.userenv.dll_DestroyEnvironmentBlock
cmp esi, 0xffffffff
je 0x51934f
push esi
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x64], 0xffffffff
je 0x519372
test bl, bl
je 0x519369
cmp dword [ebp + 8], 0
je 0x519369
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x64]
mov dword [eax], edx
jmp 0x519372
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
cmp eax, 0xffffffff
je 0x519380
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519394
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5193c3
lea eax, [ebp - 0x74]
mov edx, 4
call fcn.00406a00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a00
ret
Function at 0x519d6c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
mov eax, dword [ebp - 8]
call fcn.004069f0
xor eax, eax
push ebp
push 0x519f30
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
xor edx, edx
push ebp
push 0x519f03
push dword fs:[edx]
mov dword fs:[edx], esp
test ebx, ebx
jne 0x519dd8
push 0
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005195fc
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519f0d
xor edx, edx
push ebp
push 0x519eef
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
call fcn.00519158
mov ebx, eax
test ebx, ebx
jne 0x519e08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519f0d
mov eax, ebx
call fcn.005188c4
cmp eax, 0x3000
je 0x519e2b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519f0d
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a4c
mov dword [ebp - 0x54], 0x44
mov eax, 0x519f44
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x24], 0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x10]
push eax
call sub.userenv.dll_CreateEnvironmentBlock
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x400
push 0
push 0
push 0
push 0x519f70
push dword [ebp - 4]
push 0x519f80
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00406fc0
mov eax, dword [ebp - 0x68]
call fcn.00406a94
push eax
push 0
push ebx
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
jne 0x519eb0
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
jmp 0x519eb5
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.userenv.dll_DestroyEnvironmentBlock
cmp ebx, 0xffffffff
je 0x519ec9
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x64]
cmp eax, 0xffffffff
je 0x519ed7
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
cmp eax, 0xffffffff
je 0x519ee5
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519ef9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519f0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519f37
lea eax, [ebp - 0x68]
call fcn.004069f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a00
ret
Function at 0x51a29c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
mov eax, dword [ebp - 8]
call fcn.004069f0
xor eax, eax
push ebp
push 0x51a466
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
xor edx, edx
push ebp
push 0x51a434
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x612c10]
cmp dword [eax], 6
jl 0x51a303
xor edx, edx
mov eax, 0x51a484
call fcn.00518f78
mov ebx, eax
jmp 0x51a31a
lea eax, [ebp - 0x68]
call fcn.0051a584
mov edx, dword [ebp - 0x68]
mov eax, 0x51a4ac
call fcn.00518f78
mov ebx, eax
test ebx, ebx
jne 0x51a333
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51a43e
lea eax, [ebp - 0x6c]
call fcn.0051a584
mov eax, dword [ebp - 0x6c]
push eax
mov eax, 0x51a4ac
pop edx
call fcn.00518f78
mov esi, eax
test esi, esi
jne 0x51a365
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51a43e
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a4c
mov dword [ebp - 0x54], 0x44
mov eax, 0x51a4c8
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x24], 0
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x10]
push eax
call sub.userenv.dll_CreateEnvironmentBlock
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x400
push 0
push 0
push 0
push 0x51a4f4
push dword [ebp - 4]
push 0x51a504
push dword [ebp - 8]
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00406fc0
mov eax, dword [ebp - 0x70]
call fcn.00406a94
push eax
push 0
push ebx
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
jne 0x51a3ea
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
jmp 0x51a3ef
xor eax, eax
mov dword [ebp - 0xc], eax
cmp ebx, 0xffffffff
je 0x51a3fa
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp esi, 0xffffffff
je 0x51a405
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x10]
push eax
call sub.userenv.dll_DestroyEnvironmentBlock
mov eax, dword [ebp - 0x64]
cmp eax, 0xffffffff
je 0x51a41c
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
cmp eax, 0xffffffff
je 0x51a42a
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51a43e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a46d
lea eax, [ebp - 0x70]
mov edx, 3
call fcn.00406a00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a00
ret
Function at 0x51a584
Capabilities:
Get session information
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00406a08
cmp byte [0x61a4b4], 0
je 0x51a5bb
xor eax, eax
call fcn.0051a50c
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x51a62a
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0051a64c
jmp 0x51a62a
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 5
call fcn.00518cb0
push eax
mov eax, dword [0x60afcc]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x51a608
mov eax, ebx
mov edx, dword [esp]
call fcn.00406bb4
mov eax, dword [ebx]
mov edx, 0x51a63c
call fcn.00470308
test al, al
je 0x51a5ff
mov eax, ebx
xor edx, edx
call fcn.00406a08
mov eax, dword [esp]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
cmp dword [ebx], 0
jne 0x51a62a
xor eax, eax
call fcn.0051a50c
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x51a62a
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0051a64c
pop ecx
pop edx
pop ebx
ret
Function at 0x51a958
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51abbb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406a5c
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, 0x11c
call fcn.00403a4c
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
xor ecx, ecx
mov edx, 0x24
call fcn.00403a4c
push 0x51abc8
push 0x51abf0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409e4c
test eax, eax
je 0x51a9e2
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x51a9ee
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [ebp - 0x110], 2
jne 0x51ab9b
test bl, bl
je 0x51aa1e
call fcn.0051ad68
mov edx, dword [eax]
mov dword [ebp - 0x11c], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x118], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x51aa39
lea eax, [ebp - 4]
mov edx, 0x51ac18
call fcn.00406a5c
cmp dword [ebp - 0x11c], 5
jne 0x51aa5d
cmp dword [ebp - 0x118], 0
jne 0x51aa5d
lea eax, [ebp - 4]
mov edx, 0x51ac3c
call fcn.00406a5c
jmp 0x51ab9b
cmp dword [ebp - 0x11c], 5
jne 0x51aa81
cmp dword [ebp - 0x118], 1
jne 0x51aa81
lea eax, [ebp - 4]
mov edx, 0x51ac64
call fcn.00406a5c
jmp 0x51ab9b
cmp dword [ebp - 0x11c], 5
jne 0x51aac7
cmp dword [ebp - 0x118], 2
jne 0x51aac7
cmp byte [ebp - 6], 1
jne 0x51aab5
cmp word [ebp - 0x144], 9
jne 0x51aab5
lea eax, [ebp - 4]
mov edx, 0x51ac64
call fcn.00406a5c
jmp 0x51ab9b
lea eax, [ebp - 4]
mov edx, 0x51ac88
call fcn.00406a5c
jmp 0x51ab9b
cmp dword [ebp - 0x11c], 6
jne 0x51aaeb
cmp dword [ebp - 0x118], 0
jne 0x51aaeb
lea eax, [ebp - 4]
mov edx, 0x51acbc
call fcn.00406a5c
jmp 0x51ab9b
cmp dword [ebp - 0x11c], 6
jne 0x51ab0f
cmp dword [ebp - 0x118], 1
jne 0x51ab0f
lea eax, [ebp - 4]
mov edx, 0x51ace4
call fcn.00406a5c
jmp 0x51ab9b
cmp dword [ebp - 0x11c], 6
jne 0x51ab35
mov eax, dword [ebp - 0x118]
add eax, 0xfffffffe
sub eax, 2
jae 0x51ab35
lea eax, [ebp - 4]
mov edx, 0x51ad04
call fcn.00406a5c
jmp 0x51ab9b
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x51ab5a
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x51ab5a
lea eax, [ebp - 4]
mov edx, 0x51ad24
call fcn.00406a5c
jmp 0x51ab9b
cmp eax, 0xa
jne 0x51ab89
cmp dword [ebp - 0x114], 0x55f0
jae 0x51ab7a
lea eax, [ebp - 4]
mov edx, 0x51ad24
call fcn.00406a5c
jmp 0x51ab9b
lea eax, [ebp - 4]
mov edx, 0x51ad48
call fcn.00406a5c
jmp 0x51ab9b
cmp eax, 0xb
jb 0x51ab9b
lea eax, [ebp - 4]
mov edx, 0x51ad48
call fcn.00406a5c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51abc2
lea eax, [ebp - 4]
call fcn.004069f8
ret

Function at 0x51ae98
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406c08
add esp, 0x200
pop ebx
ret
Function at 0x51bba8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x51bbd8
push 0
push 0
mov eax, edi
call fcn.00406a94
push eax
mov eax, ebx
call fcn.00406a94
push eax
push 0
push esi
call sub.shell32.dll_ShellExecuteW
jmp 0x51bbf4
push 1
push 0
mov eax, edi
call fcn.00406a94
push eax
mov eax, ebx
call fcn.00406a94
push eax
push 0
push esi
call sub.shell32.dll_ShellExecuteW
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x51c72c
Capabilities:
Check os version
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51c958
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406a5c
mov eax, dword [ebp - 4]
call fcn.0051c170
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x51c784
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407284
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0051cd28
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x51c85f
xor eax, eax
push ebp
push 0x51c858
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0051c41c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0051c9c4
test al, al
je 0x51c836
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406b44
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x51c836
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00406a94
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x51c830
mov eax, dword [ebp - 8]
call fcn.00406a94
mov edx, eax
lea eax, [ebp - 0x150]
call fcn.00406bb4
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0xc]
call fcn.0051c72c
dec ebx
cmp ebx, 0xffffffff
jne 0x51c7e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c85f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0051c41c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x1d], 0
je 0x51c912
cmp dword [0x61a4cc], 0
je 0x51c8a4
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0051c408
push eax
call dword [0x61a4cc]
test eax, eax
sete bl
jmp 0x51c932
mov dword [ebp - 0x14c], 0x114
lea eax, [ebp - 0x14c]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x148], 5
jne 0x51c912
push 0x51c968
push 0x51c988
call sub.kernel32.dll_LoadLibraryW
push eax
call fcn.00409e4c
mov dword [0x61a4cc], eax
cmp dword [0x61a4cc], 0
je 0x51c912
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0051c408
push eax
call dword [0x61a4cc]
test eax, eax
sete bl
jmp 0x51c932
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0051c408
push eax
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c95f
lea eax, [ebp - 0x150]
call fcn.004069f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a00
ret
Function at 0x51c85f
Capabilities:
Check os version
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51c958
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406a5c
mov eax, dword [ebp - 4]
call fcn.0051c170
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x51c784
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407284
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0051cd28
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x51c85f
xor eax, eax
push ebp
push 0x51c858
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0051c41c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0051c9c4
test al, al
je 0x51c836
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406b44
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x51c836
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00406a94
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x51c830
mov eax, dword [ebp - 8]
call fcn.00406a94
mov edx, eax
lea eax, [ebp - 0x150]
call fcn.00406bb4
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0xc]
call fcn.0051c72c
dec ebx
cmp ebx, 0xffffffff
jne 0x51c7e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c85f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0051c41c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x1d], 0
je 0x51c912
cmp dword [0x61a4cc], 0
je 0x51c8a4
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0051c408
push eax
call dword [0x61a4cc]
test eax, eax
sete bl
jmp 0x51c932
mov dword [ebp - 0x14c], 0x114
lea eax, [ebp - 0x14c]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x148], 5
jne 0x51c912
push 0x51c968
push 0x51c988
call sub.kernel32.dll_LoadLibraryW
push eax
call fcn.00409e4c
mov dword [0x61a4cc], eax
cmp dword [0x61a4cc], 0
je 0x51c912
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0051c408
push eax
call dword [0x61a4cc]
test eax, eax
sete bl
jmp 0x51c932
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0051c408
push eax
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c95f
lea eax, [ebp - 0x150]
call fcn.004069f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a00
ret