joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5773b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5773d4
xor eax, eax
jmp 0x577454
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5773eb
xor eax, eax
jmp 0x577454
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x577437
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x577437
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x57740e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x577443
xor eax, eax
jmp 0x577454
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x577451
xor eax, eax
jmp 0x577454
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x591a50
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73496d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x20]
add eax, 4
push eax
lea ecx, [ebp - 0x10]
call fcn.0057d860
mov dword [ebp - 4], 0
push 0x7606bc
push 0x7606bc
lea ecx, [ebp - 0x10]
call fcn.0059acf0
mov ecx, eax
call fcn.0059ab50
mov ecx, str.Temp
test ecx, ecx
jne 0x591ac0
mov dword [ebp - 0x14], 0
jmp 0x591ad0
push str.Temp
call fcn.00710f40
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push str.Temp
lea ecx, [ebp - 0x10]
call fcn.005804a0
lea ecx, [ebp - 0x10]
call fcn.005785c0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x591b19
lea ecx, [ebp - 0x10]
call fcn.005785c0
mov dword [ebp - 0x28], eax
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.0057d860
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
sub ecx, 0x10
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00577240
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x597b00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x734f2d
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x150], ecx
mov dword [ebp - 4], 0
push 0x128
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0070dc20
add esp, 0xc
mov byte [ebp - 0x139], 0
mov dword [ebp - 0x140], 1
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x138], 0x128
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32First
cmp dword [ebp - 0x140], 0
je 0x597be8
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x140], eax
lea ecx, [ebp + 8]
call fcn.005785c0
mov dword [ebp - 0x148], eax
mov edx, dword [ebp - 0x148]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.007152d0
add esp, 8
test eax, eax
jne 0x597be6
mov byte [ebp - 0x139], 1
mov dword [ebp - 0x140], 0
jmp 0x597b8b
mov cl, byte [ebp - 0x139]
mov byte [ebp - 0x13a], cl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
sub edx, 0x10
mov dword [ebp - 0x14c], edx
mov ecx, dword [ebp - 0x14c]
call fcn.00577240
mov al, byte [ebp - 0x13a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret 4

Function at 0x599c90
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73510d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.005785c0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x599d2b
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x54]
push edx
push str.SetCurrentDirectory_failed.__s
push str.CFTPImpl::SetDownloadDirectory
push 0x5a1
push str.D:Bit_BucketBTS_RetailSP24PLUS_REQ_frontendodin_groupFTUpdateServiceFTPHandler.h
push 4
push 0
call fcn.00595750
push eax
call fcn.00597650
add esp, 0x20
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
sub eax, 0x10
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.00577240
mov al, byte [ebp - 0xd]
jmp 0x599d4a
mov byte [ebp - 0xe], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
sub ecx, 0x10
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call fcn.00577240
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x599d60
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7350dd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.005785c0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, 1
jne 0x599dca
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
sub ecx, 0x10
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.00577240
mov al, byte [ebp - 0xd]
jmp 0x599de9
mov byte [ebp - 0xe], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
sub edx, 0x10
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
call fcn.00577240
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5a2370
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x735740
mov eax, dword fs:[0]
push eax
sub esp, 0x8e4
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8d0], ecx
mov byte [ebp - 0x8c9], 0
push str.FTUPDATESERVICE_E124ADA3_76AA_499A_B1FB_6C54137575FC
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x8f0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5a23d6
mov dword [ebp - 0x8d8], 1
jmp 0x5a23e0
mov dword [ebp - 0x8d8], 0
mov al, byte [ebp - 0x8d8]
mov byte [ebp - 0x8c9], al
movzx ecx, byte [ebp - 0x8c9]
test ecx, ecx
je 0x5a240c
push 0
push 0
push str.Another_instance_is_already_running_in_this_machine
call fcn.005d2e76
xor eax, eax
jmp 0x5a2544
push str.Program_starting
push str.CFTUpdateServiceApp::InitInstance
push 0x12b
push str.D:Bit_BucketBTS_RetailSP24PLUS_REQ_frontendodin_groupFTUpdateServiceFTUpdateService.cpp
push 0
push 0
call fcn.00595750
push eax
call fcn.00597650
add esp, 0x1c
mov dword [ebp - 0x8ec], 8
mov dword [ebp - 0x8e8], 0xff
lea edx, [ebp - 0x8ec]
push edx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x8d0]
call fcn.005db141
push 0
call fcn.005dccbe
add esp, 4
call fcn.005da715
mov eax, dword [eax + 8]
mov dword [ebp - 0x8e0], eax
mov ecx, dword [ebp - 0x8d0]
mov edx, dword [ebp - 0x8e0]
mov dword [ecx + 0xcc], edx
mov dword [ebp - 0x8d4], 0
push 0
lea ecx, [ebp - 0x8c8]
call fcn.005a7080
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x8d0]
lea ecx, [ebp - 0x8c8]
mov dword [eax + 0x20], ecx
push 0
mov edx, 0x66
movzx eax, dx
push eax
lea ecx, [ebp - 0x8c8]
call fcn.005d1d7f
test eax, eax
je 0x5a2522
push 0
lea ecx, [ebp - 0x8c8]
call fcn.005d0e99
lea ecx, [ebp - 0x8c8]
test ecx, ecx
jne 0x5a24f2
mov dword [ebp - 0x8dc], 0
jmp 0x5a24fe
mov edx, dword [ebp - 0x8a8]
mov dword [ebp - 0x8dc], edx
push 1
mov eax, dword [ebp - 0x8dc]
push eax
call fcn.005a25a0
add esp, 8
push 0
lea ecx, [ebp - 0x8c8]
call fcn.005cd7d3
mov dword [ebp - 0x8d4], eax
mov dword [ebp - 0x8e4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c8]
call fcn.005a8480
mov eax, dword [ebp - 0x8e4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x5ab2a0
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7361fd
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
jmp 0x5ab307
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x14]
call fcn.0057fc20
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 0x1c]
add edx, 4
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
cmp eax, dword [edx]
jne 0x5ab33d
mov dword [ebp - 0x20], 1
jmp 0x5ab344
mov dword [ebp - 0x20], 0
mov cl, byte [ebp - 0x20]
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
jne 0x5ab35b
mov dword [ebp - 0x24], 1
jmp 0x5ab362
mov dword [ebp - 0x24], 0
mov al, byte [ebp - 0x24]
mov byte [ebp - 0xe], al
movzx ecx, byte [ebp - 0xe]
test ecx, ecx
je 0x5ab461
mov edx, dword [ebp - 0x14]
add edx, 0x10
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
add ecx, 4
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x68]
add edx, 0x68
push edx
lea ecx, [ebp - 0x18]
call fcn.0057d860
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.005b2670
push eax
push 0
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x18]
call fcn.005979f0
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x70], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x70]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0057d860
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x74]
sub ecx, 0x10
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x78]
call fcn.00577240
lea ecx, [ebp - 0x2c]
call fcn.005785c0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 5
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.005785c0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
sub edx, 0x10
mov dword [ebp - 0x7c], edx
mov ecx, dword [ebp - 0x7c]
call fcn.00577240
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
sub eax, 0x10
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
call fcn.00577240
jmp 0x5ab2f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5abed0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], ecx
push 0
push 0x763288
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x5abf2c
push 0
push str.TrayNotifyWnd
push 0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x5abf2c
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x5ac050
mov dword [ebp - 0x28], 0x24
lea eax, [ebp - 0x28]
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x5abfb2
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 3
ja case.default.0x5abf52
mov edx, dword [ebp - 0x34]
jmp dword [edx*4 + 0x5ac060]
mov eax, dword [ebp - 0xc]
sub eax, 0x64
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
sub edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
jmp case.default.0x5abf52
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x64
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
jmp 0x5ac050
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x5ac020
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
cmp edx, 0x96
jle 0x5abffe
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
sub ecx, 0x96
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
cmp edx, 0x1e
jle 0x5ac01e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
sub ecx, 0x1e
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
jmp 0x5ac050
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
sub edx, 0x96
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
sub edx, 0x1e
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret 4
Function at 0x5b26c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7369cb
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x89eea4
lea ecx, [ebp - 0x420]
call fcn.0057d860
mov dword [ebp - 4], 0
push 0x7625f3
push 0x762cb4
lea ecx, [ebp - 0x420]
call fcn.00598370
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x440], 0
push 0x7625f6
lea ecx, [ebp - 0x430]
call fcn.00577f20
mov byte [ebp - 4], 1
push 0x400
push 0
lea eax, [ebp - 0x410]
push eax
call fcn.0070dc20
add esp, 0xc
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x428], 0x400
lea ecx, [ebp - 0x420]
call fcn.005785c0
mov dword [ebp - 0x42c], eax
lea ecx, [ebp - 0x418]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0x42c]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x5b2826
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x424]
push edx
push 0
push 0x762d0c
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x5b2826
cmp dword [ebp - 0x428], 0
jbe 0x5b2826
push 0x762d30
push 0x762d44
mov ecx, 0x89eea4
call fcn.00598370
mov dword [reloc.OLEAUT32.dll_SysReAllocString], 0x80000001
cmp dword [ebp - 0x418], 0
je 0x5b283c
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x411], 1
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x430]
sub edx, 0x10
mov dword [ebp - 0x434], edx
mov ecx, dword [ebp - 0x434]
call fcn.00577240
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x420]
sub eax, 0x10
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
call fcn.00577240
mov al, byte [ebp - 0x411]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x5b9f50
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x610], ecx
push 0x400
push 0
lea eax, [ebp - 0x60c]
push eax
call fcn.0070dc20
add esp, 0xc
mov dword [ebp - 0x614], 0x401
mov dword [ebp - 0x614], 0x400
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x60c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00710f40
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005b9d60
add esp, 0x10
test eax, eax
je 0x5b9fd3
push str.Conversion_from_base64_Successfully
mov ecx, dword [ebp - 0x610]
call fcn.005ba910
jmp 0x5ba030
push 0x101
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.0070dc20
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x614]
push ecx
push str.ERROR:Conversion_from_Base64_Failed__Length_dValue_s_ErrorCode_ld
push 0x100
lea edx, [ebp - 0x108]
push edx
call fcn.005bafc0
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x610]
call fcn.005ba910
mov eax, 7
jmp 0x5ba14b
mov ecx, dword [ebp - 0x614]
mov dword [ebp - 0x618], ecx
mov edx, dword [ebp - 0x610]
mov byte [edx + 0x10], 1
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x60c]
push ecx
push 0
mov edx, dword [ebp - 0x610]
movzx eax, byte [edx + 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x610]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x5ba0d6
push 0x101
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0070dc20
add esp, 0xc
lea ecx, [ebp - 0x60c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x618]
push edx
push str.ERROR_in_Decrpytion__Length_d_ErrorCode_ld_Value_s
push 0x100
lea eax, [ebp - 0x20c]
push eax
call fcn.005bafc0
add esp, 0x18
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x610]
call fcn.005ba910
mov eax, 8
jmp 0x5ba14b
push 0
push 0
mov edx, dword [ebp - 0x618]
shr edx, 1
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x60c]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push str.Text_Decrypted_Successfully
mov ecx, dword [ebp - 0x610]
call fcn.005ba910
push 0x401
push 0
mov edx, dword [ebp - 0x610]
add edx, 0x101f
push edx
call fcn.0070dc20
add esp, 0xc
mov eax, dword [ebp - 0x614]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x610]
add edx, 0xc1e
push edx
call fcn.0070d6a0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret 8
Function at 0x5bc4e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x737145
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
push 0x7652d1
lea ecx, [ebp - 0x14]
call fcn.00577f20
mov byte [ebp - 4], 1
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp + 0xc]
call fcn.005785c0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
push 0x20219
push 0
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5bc5f4
lea eax, [ebp - 0x18]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5bc5f4
cmp dword [ebp - 0x1c], 4
jne 0x5bc5f4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x14]
call fcn.00577170
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x14]
call fcn.005785c0
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
push edx
call fcn.00716372
add esp, 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.005c2f70
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x10], 0
je 0x5bc604
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
sub ecx, 0x10
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
call fcn.00577240
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
sub edx, 0x10
mov dword [ebp - 0x3c], edx
mov ecx, dword [ebp - 0x3c]
call fcn.00577240
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10