joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5baf37cd
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x5bb70c3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x334], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x330]
push eax
push 1
xor esi, esi
push esi
push 0x5ba4c690
mov edi, 0x5ba4e964
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x328], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5baf38ac
push ebx
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x32c]
push eax
push esi
push 0x5ba4c824
push dword [ebp - 0x330]
mov ebx, 0x104
mov dword [ebp - 0x33c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5baf389f
cmp dword [ebp - 0x32c], 2
jne 0x5baf3880
push ebx
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x324]
jmp 0x5baf3886
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x328], eax
call sub.SHLWAPI.dll_PathAddBackslashA
push ebx
push edi
push dword [ebp - 0x328]
call sub.SHLWAPI.dll_StrCatBuffA
push dword [ebp - 0x330]
call dword [entry0]
pop ebx
push dword [ebp - 0x338]
lea eax, [ebp - 0x220]
push dword [ebp - 0x334]
push dword [ebp - 0x328]
push 0x5ba4795c
push 0x118
push eax
call sub.SHLWAPI.dll_wnsprintfA
add esp, 0x18
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x390]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x390]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push esi
mov dword [ebp - 0x390], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x5baf3971
push 0xffffffffffffffff
push dword [ebp - 0x34c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x34c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x5baf3943
mov dword [ebp - 0x32c], 0x80004005
push dword [ebp - 0x348]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x34c]
call edi
mov eax, 0x800c0321
cmp dword [ebp - 0x32c], eax
jne 0x5baf396d
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
jmp 0x5baf3976
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.5bb3f314
leave
ret 0xc
Function at 0x5baf58f1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x5bb707a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x5baf593c
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.5baf4b98
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
add eax, 0x300
push eax
call fcn.5bb0e034
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ecx], eax
push dword [0x5bb707a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop ebp
ret 0x14

Function at 0x5baf66c2
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5bb70c3c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi + 0x14]
mov dword [ebp - 4], eax
mov edi, ecx
xor ebx, ebx
call sub.MSOERT2.dll_FIsEmptyA
test eax, eax
jne 0x5baf6731
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0x5ba4cc94
push dword [esi + 0x14]
push dword [edi + 0xc]
call fcn.5ba572e2
mov ebx, eax
test ebx, ebx
jl 0x5baf6731
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x5baf6731
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.MSOERT2.dll_PszDupA
push eax
call sub.MSOERT2.dll_DeleteTempFileOnShutdownEx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.5bb3f314
leave
ret 4

Function at 0x5baf7c8a
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x5baf7cc1
push eax
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_KillTimer]
and dword [esi + 0x24], 0
push 5
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x5baf7cc1
push eax
call dword [sym.imp.USER32.dll_SetCursor]
and dword [esi + 0x20], 0
pop esi
ret
Function at 0x5bb0dedb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
lea ecx, [ebp + 8]
push ecx
xor edi, edi
push 0x133403f5
inc edi
push esi
mov dword [ebp - 4], edi
call dword [eax + 0x10]
test eax, eax
jl 0x5bb0df17
cmp dword [ebp + 8], 0
je 0x5bb0df17
call fcn.5ba5d2cf
test eax, eax
je 0x5bb0df17
mov eax, edi
jmp 0x5bb0e029
mov eax, dword [ebp + 0x14]
push ebx
lea ecx, [eax + 0x300]
lea ebx, [eax + 0x200]
lea edi, [eax + 0x100]
mov dword [ebp - 0x24], eax
mov eax, dword [eax + 0x514]
and al, 2
mov dword [ebp - 0x20], ecx
xor ecx, ecx
cmp al, 2
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
setne cl
push 0x5ba4cb50
push 0x5ba4c690
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 8], 4
mov dword [ebp - 0x14], ecx
call sub.SHLWAPI.dll_SHGetValueA
test eax, eax
jne 0x5bb0df84
cmp dword [ebp + 8], eax
jne 0x5bb0df84
mov dword [ebp - 0x10], 1
jmp 0x5bb0df88
and dword [ebp - 0x10], 0
cmp dword [ebp + 0x10], 0
jne 0x5bb0dfb6
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5bb0dfb6
mov ecx, dword [eax]
lea edx, [ebp + 0x10]
push edx
push eax
call dword [ecx + 0x40]
test eax, eax
jge 0x5bb0dfa7
and dword [ebp + 0x10], 0
cmp dword [ebp + 0x10], 0
je 0x5bb0dfb6
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x24]
push eax
push 0x5bb0da40
push dword [ebp + 0x10]
push 0x10
push dword [0x5bb73708]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
je 0x5bb0e025
mov eax, dword [esi]
push edi
push dword [ebp + 0x18]
push esi
call dword [eax + 0x20]
mov eax, dword [esi]
xor edi, edi
cmp dword [ebp - 0x14], edi
je 0x5bb0dff2
push ebx
push dword [ebp + 0x1c]
push esi
call dword [eax + 0x20]
jmp 0x5bb0dffb
push edi
push edi
push dword [ebp + 0x1c]
push esi
call dword [eax + 0x18]
cmp dword [ebp - 0x10], edi
je 0x5bb0e017
cmp dword [ebp + 0x20], edi
je 0x5bb0e017
mov eax, dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x14], edi
sete cl
push ecx
push dword [ebp + 0x20]
push esi
call dword [eax + 0x1c]
cmp dword [ebp + 0x24], edi
je 0x5bb0e022
mov eax, dword [esi]
push esi
call dword [eax + 0x30]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 0x20
Function at 0x5bb23402
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5bb70c3c]
push ebx
push edi
push 9
mov dword [ebp - 4], eax
xor eax, eax
mov ebx, ecx
pop ecx
mov byte [ebp - 0x204], al
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x22c]
push eax
push 0
push 0x1005
push dword [ebx + 0x1c]
mov dword [ebp - 0x22c], 0xd
mov dword [ebp - 0x21c], 0xf003
mov dword [ebp - 0x214], 0x200
call edi
test eax, eax
je 0x5bb234e3
push esi
mov esi, dword [ebp + 0xc]
neg esi
sbb esi, esi
lea eax, [ebp - 0x22c]
push eax
and esi, 3
push 0
dec esi
add esi, dword [ebp + 8]
push 0x1007
push dword [ebx + 0x1c]
mov dword [ebp - 0x228], esi
call edi
cmp eax, 0xffffffff
je 0x5bb234e2
push 0
push esi
push 0x1013
push dword [ebx + 0x1c]
call edi
push esi
push esi
push 0x1015
push dword [ebx + 0x1c]
call edi
cmp dword [ebp + 0xc], 0
jne 0x5bb234cb
inc dword [ebp + 8]
push 0
push dword [ebp + 8]
push 0x1008
push dword [ebx + 0x1c]
call edi
test eax, eax
je 0x5bb234e2
or dword [ebx + 0x10], 2
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.5bb3f314
leave
ret 8
Function at 0x5bb26b6f
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5bb70c3c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x244], ebx
lea edi, [ebp - 0x240]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 9
stosd dword es:[edi], eax
mov esi, ecx
pop ecx
push 8
xor eax, eax
mov dword [ebp - 0x234], ebx
lea edi, [ebp - 0x230]
rep stosd dword es:[edi], eax
pop ecx
push 2
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x244]
push eax
push dword [esi + 0x14]
mov dword [ebp - 0x264], edi
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x23c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
sub ecx, eax
lea eax, [ebp - 0x264]
push eax
push ebx
push 0x101b
push dword [esi + 0x14]
mov dword [ebp - 0x25c], ecx
call edi
push ebx
push ebx
push 0xff00ff
push ebx
push 0x10
push 4
push dword [0x5bb73708]
call dword [fcn.5ba56040]
cmp eax, ebx
je 0x5bb26c27
push eax
push 2
push 0x1003
push dword [esi + 0x14]
call edi
push 0x20
push ebx
push 0x1036
push dword [esi + 0x14]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x204]
mov dword [ebp - 0x234], 0xd
mov dword [ebp - 0x224], 0xf000
mov dword [ebp - 0x228], 0x7000
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x20c], 0x5ba49d6c
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
test ecx, 0x40
jne 0x5bb26d86
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x5bb26c9b
test ecx, 8
je 0x5bb26d86
cmp eax, 1
jne 0x5bb26cac
test ecx, 0x10
je 0x5bb26d86
cmp eax, 2
jne 0x5bb26cbd
test ecx, 0x20
je 0x5bb26d86
push 0x200
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x20c]
push dword [eax + 4]
push dword [0x5bb73708]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x5bb26d86
push 0x5ba4f20c
lea eax, [ebp - 0x204]
push eax
jmp 0x5bb26d3d
lea eax, [ebp - 4]
sub eax, ebx
push eax
push 0x5ba4f20c
call edi
add eax, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x5ba4f210
push ebx
call sub.SHLWAPI.dll_StrStrA
mov ebx, eax
test ebx, ebx
je 0x5bb26db0
lea eax, [ebp - 4]
sub eax, ebx
push eax
push 0x5ba4f210
call edi
add eax, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x5ba4f20c
push ebx
call sub.SHLWAPI.dll_StrStrA
mov ebx, eax
test ebx, ebx
jne 0x5bb26cf4
lea eax, [ebp - 0x204]
push eax
call edi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x234]
push eax
push ebx
push 0x1007
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x5bb26d84
inc dword [ebp - 0x230]
xor ebx, ebx
inc dword [ebp - 0x208]
add dword [ebp - 0x20c], 0x10
cmp dword [ebp - 0x208], 0x15
jb 0x5bb26c74
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret
xor eax, eax
jmp 0x5bb26da3
Function at 0x5bb26fd6
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2a8
mov eax, dword [0x5bb70c3c]
push ebx
push edi
mov ebx, ecx
push 9
xor edx, edx
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0x254]
mov dword [ebp - 0x258], edx
rep stosd dword es:[edi], eax
push 9
pop ecx
lea edi, [ebp - 0x22c]
mov dword [ebp - 0x230], edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x5bb27022
xor eax, eax
jmp 0x5bb271e8
mov dword [ebp - 0x254], eax
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x204]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x258]
push eax
push edx
push 0x1005
push dword [ebx + 0x14]
mov edi, 0xf000
mov dword [ebp - 0x258], 0xd
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], 0x200
call esi
test eax, eax
jne 0x5bb27077
xor eax, eax
jmp 0x5bb271e7
cmp dword [ebp - 0x24c], 0xc000
je 0x5bb271e4
mov eax, dword [ebp - 0x238]
shl eax, 4
test dword [eax + 0x5ba49d6c], 4
je 0x5bb2718e
push 0
push 0
push 0x1004
push dword [ebx + 0x14]
call esi
and dword [ebp - 0x22c], 0
test eax, eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x230], 0xc
mov dword [ebp - 0x220], edi
jle 0x5bb2718e
lea eax, [ebp - 0x230]
push eax
push 0
push 0x1005
push dword [ebx + 0x14]
call esi
test eax, eax
je 0x5bb27070
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x238], eax
jne 0x5bb27103
mov eax, dword [ebp - 0x22c]
mov dword [ebp + 8], eax
jmp 0x5bb27176
cmp dword [ebp - 0x224], 0x8000
jne 0x5bb27142
mov ecx, dword [ebx + 0x28]
push 0
shl eax, 4
push dword [eax + 0x5ba49d68]
call fcn.5bb2fb9f
test eax, eax
jl 0x5bb27070
mov dword [ebp - 0x298], edi
mov dword [ebp - 0x29c], 0xc000
lea eax, [ebp - 0x2a8]
jmp 0x5bb27165
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x5000
add eax, 0x7000
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], edi
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x22c]
push 0x102b
push dword [ebx + 0x14]
call esi
inc dword [ebp - 0x22c]
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x208]
jl 0x5bb270d3
mov eax, dword [ebp - 0x238]
push dword [ebp + 0xc]
mov ecx, dword [ebx + 0x28]
shl eax, 4
push dword [eax + 0x5ba49d68]
call fcn.5bb2fb9f
test eax, eax
jl 0x5bb27070
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x280]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x270], edi
push 0x102b
push dword [ebx + 0x14]
mov dword [ebp - 0x274], 0x8000
jne 0x5bb271e2
mov dword [ebp - 0x274], 0x7000
call esi
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.5bb3f314
leave
ret 8
Function at 0x5bb27cb1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push esi
mov esi, ecx
test dword [esi + 8], 8
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
je 0x5bb27cdf
xor edi, edi
inc edi
jmp 0x5bb27daa
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0x5ba4f1d0
call fcn.5ba7bd2a
test eax, eax
je 0x5bb27d04
mov edi, 0x80004005
jmp 0x5bb27d8a
push ebx
push 4
pop ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov edi, 0x5ba4cabc
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5bb27d56
cmp eax, 2
je 0x5bb27d36
mov edi, 0x80004005
jmp 0x5bb27d89
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push edi
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x50000
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x5bb27d2f
lea eax, [ebp - 4]
push eax
call fcn.5bb329eb
mov edi, eax
test edi, edi
jl 0x5bb27d89
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0x5ba4f1d0
push eax
call dword [ecx + 0x24]
mov edi, eax
test edi, edi
jl 0x5bb27d89
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
or dword [esi + 8], 8
mov dword [esi + 0x20], eax
xor edi, edi
pop ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x5bb27d9b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x5bb27daa
push dword [ebp - 8]
call dword [entry0]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x5bb27db5
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5bb70c3c]
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
test dword [edi + 8], 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], esi
jne 0x5bb27dec
xor ebx, ebx
inc ebx
jmp 0x5bb27f22
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0xf003f
push 0x5ba4f308
call fcn.5ba7bd2a
test eax, eax
je 0x5bb27e17
mov ebx, 0x80004005
jmp 0x5bb27f0d
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push esi
push 0x5ba4cabc
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x50000
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x5bb27e0d
mov ebx, 0x5ba4eaf0
push ebx
push dword [ebp - 0x10c]
call sub.SHLWAPI.dll_SHDeleteKeyA
mov esi, 0x104
push esi
push 0x5ba4f308
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
push 0x5ba4cc98
lea eax, [ebp - 0x108]
push eax
call sub.SHLWAPI.dll_StrCatBuffA
push esi
push ebx
lea eax, [ebp - 0x108]
push eax
call sub.SHLWAPI.dll_StrCatBuffA
cmp dword [edi + 0x18], 0
je 0x5bb27ea9
mov eax, dword [edi + 0x18]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x108]
push edx
push eax
call dword [ecx + 0x28]
mov ebx, eax
test ebx, ebx
jl 0x5bb27f0d
mov ebx, 0x5ba4eaf8
push ebx
push dword [ebp - 0x10c]
call sub.SHLWAPI.dll_SHDeleteKeyA
push esi
push 0x5ba4f308
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
push 0x5ba4cc98
lea eax, [ebp - 0x108]
push eax
call sub.SHLWAPI.dll_StrCatBuffA
push esi
push ebx
lea eax, [ebp - 0x108]
push eax
call sub.SHLWAPI.dll_StrCatBuffA
cmp dword [edi + 0x1c], 0
je 0x5bb27f0b
mov edi, dword [edi + 0x1c]
mov eax, dword [edi]
push 1
lea ecx, [ebp - 0x108]
push ecx
push edi
call dword [eax + 0x28]
mov ebx, eax
test ebx, ebx
jl 0x5bb27f0d
xor ebx, ebx
cmp dword [ebp - 0x10c], 0
je 0x5bb27f22
push dword [ebp - 0x10c]
call dword [entry0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.5bb3f314
leave
ret

Function at 0x5bb27f36
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5bb70c3c]
push ebx
push esi
xor ebx, ebx
mov esi, ecx
test dword [esi + 8], 8
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x5bb27f60
xor esi, esi
inc esi
jmp 0x5bb27fce
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0xf003f
mov edi, 0x5ba4f1d0
push edi
call fcn.5ba7bd2a
test eax, eax
je 0x5bb27f84
mov esi, 0x80004005
jmp 0x5bb27fbf
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x5ba4cabc
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x50000
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x5bb27f7d
cmp dword [esi + 0x20], ebx
je 0x5bb27fbd
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x28]
mov esi, eax
cmp esi, ebx
jl 0x5bb27fbf
xor esi, esi
cmp dword [ebp - 8], ebx
pop edi
je 0x5bb27fce
push dword [ebp - 8]
call dword [entry0]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret
Function at 0x5bb2992e
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], 0x300
push esi
mov esi, ecx
mov dword [ebp - 4], ebx
jne 0x5bb29972
cmp dword [ebp + 0xc], 0x80
jne 0x5bb29a4b
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
neg eax
sbb eax, eax
neg eax
push eax
push 1
push dword [esi + 0xc]
call fcn.5bb1bea1
jmp 0x5bb29a4b
cmp dword [ebp + 8], ebx
je 0x5bb29981
cmp dword [ebp + 8], 1
jne 0x5bb29a4b
mov eax, dword [ebp + 0xc]
dec eax
je 0x5bb299a1
dec eax
jne 0x5bb29a4b
push 2
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EndDialog]
xor ebx, ebx
inc ebx
jmp 0x5bb29a4b
push edi
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
inc edi
push edi
lea eax, [ebp - 4]
push eax
call fcn.5baaee23
test eax, eax
jl 0x5bb29a4a
mov eax, dword [ebp - 4]
push edi
mov byte [eax], bl
push dword [ebp - 4]
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
xor edi, edi
inc edi
push edi
push edi
push dword [ebp - 4]
call sub.MSOERT2.dll_UlStripWhitespace
test eax, eax
jne 0x5bb29a19
push 0x5ba5f15a
push sub.SHLWAPI.dll_Ordinal_107
push 0x40
push ebx
push 0x1a27
push 0x1073
push dword [esi + 0xc]
push dword [0x5bb73708]
call sub.MSOERT2.dll_MessageBoxInstW
mov eax, dword [0x5bb73714]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp 0x5bb29a4a
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 4]
cmp ecx, ebx
je 0x5bb29a35
mov eax, dword [0x5bb73714]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
mov eax, dword [esi + 0x14]
mov dword [eax + 4], ebx
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 4]
push edi
mov dword [eax + 4], ecx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EndDialog]
mov ebx, edi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x5bb2d26e
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
xor esi, esi
push 0x1e
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
mov dword [ebp - 0x80], esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, esi
mov dword [ebp - 4], ebx
je case.0x5bb2d2af.3
mov ecx, dword [eax]
shl ecx, 4
mov ecx, dword [ecx + 0x5ba4a1f0]
dec ecx
cmp ecx, 0x10
ja case.0x5bb2d2af.3
movzx ecx, byte [ecx + 0x5bb2d3fe]
jmp dword [ecx*4 + 0x5bb2d3e2]
cmp word [eax + 0x18], si
je 0x5bb2d3d1
xor ebx, ebx
jmp 0x5bb2d3d9
cmp word [eax + 0x18], 0x13
jne 0x5bb2d3d9
jmp 0x5bb2d3d1
cmp word [eax + 0x18], 0x13
jne 0x5bb2d3d9
cmp dword [eax + 0x20], esi
jmp 0x5bb2d35d
cmp word [eax + 0x18], 0x41
jne 0x5bb2d3d9
cmp dword [eax + 0x20], esi
je 0x5bb2d3d9
mov edi, dword [eax + 0x24]
push edi
call fcn.5bb1dd29
test eax, eax
jne 0x5bb2d3d9
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x80]
push edx
push dword [edi + 8]
push eax
call dword [ecx + 0xe0]
test eax, eax
jl 0x5bb2d3d9
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x80]
push edx
push eax
call dword [ecx + 0x28]
jmp 0x5bb2d3d1
cmp word [eax + 0x18], 0x1e
jne case.0x5bb2d2af.3
mov eax, dword [eax + 0x20]
cmp eax, esi
je case.0x5bb2d2af.3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x5bb2d3d9
jmp 0x5bb2d3d1
cmp word [eax + 0x18], 0x1e
mov dword [ebp + 8], esi
jne case.0x5bb2d2af.3
mov eax, dword [eax + 0x20]
cmp eax, esi
je case.0x5bb2d2af.3
push eax
push esi
call sub.MSOERT2.dll_PszToUnicode
mov edi, eax
cmp edi, esi
je case.0x5bb2d2af.3
push esi
lea eax, [ebp + 8]
push eax
push esi
push edi
call fcn.5bb1b907
push dword [ebp + 8]
mov ebx, eax
mov eax, dword [0x5bb73714]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [0x5bb73714]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
cmp ebx, esi
jl case.0x5bb2d2af.3
push 0x54
call fcn.5ba5c700
test eax, eax
jne 0x5bb2d3d6
push 0x55
call fcn.5ba5c700
test eax, eax
jne 0x5bb2d3d6
xor ebx, ebx
inc ebx
jmp 0x5bb2d3d9
mov ebx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4