joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f450
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f483
push esi
call fcn.00442560
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f47c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43f509
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43f4f2
mov eax, dword [esi + 8]
test eax, eax
je 0x43f4a7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f4ee
cmp eax, 2
je 0x43f4f2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f49a
cmp eax, 3
je 0x43f4cd
cmp eax, 1
jne 0x43f49a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f49a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f49a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043f530
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43f518
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043f530
add esp, 4
pop esi
ret

Function at 0x44b040
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44b0e3
test eax, eax
jbe 0x44b0e3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44b0e3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44b08e
xor esi, esi
jmp 0x44b094
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44b0bf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0044d010
add esi, eax
push esi
mov ebx, esi
call fcn.0044d010
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44b0a0
pop ebp
test edi, edi
pop edi
jne 0x44b0e3
test ebx, ebx
je 0x44b0e3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00458910
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x44b225
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44b33d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44b33d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004697d3
mov esi, eax
test esi, esi
je 0x44b33d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44b33d
mov ecx, esi
call fcn.0044b190
cmp edi, eax
jge 0x44b33d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44b2c3
mov dword [esp + 0x34], 1
jmp 0x44b31e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44b33d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044a790
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x46a177
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46a1af
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046822e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00468206
jmp 0x46a1bb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46b868
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46b8aa
call fcn.00471553
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46b8aa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46b8a1
xor eax, eax
jmp 0x46b8b2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046b8b8
pop edi
pop esi
pop ebx
ret 4
Function at 0x471a83
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x471ab1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x471acf
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004719e9
jmp 0x471acf
mov eax, dword [esi + 0x14]
test eax, eax
je 0x471acf
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004719e9
test edi, edi
mov eax, edi
jne 0x471ab9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5fd8d312
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
push edx
push 0
push 0
push 2
pop edx
call fcn.5fd8d358
mov esi, eax
test esi, esi
je 0x5fd8d34a
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0xfffffffffffffffb
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5fd8d680
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.CRYPTBASE.dll_SystemFunction036]
test al, al
je 0x5fdb5e46
mov ax, word [ebp - 4]
test ax, ax
je 0x5fd8d686
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdb5e77
test byte [eax + 0x1c], 0x10
je 0x5fdb5e77
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push eax
mov eax, dword [0x5fde9010]
mov edx, 0x5fdbd9f8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x45
pop ecx
call fcn.5fdc7d09
xor eax, eax
jmp 0x5fd8d6a3
Function at 0x5fd91500
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
push 0x29
mov edi, ebx
pop ecx
mov eax, dword [0x5fde9010]
mov esi, dword [ebp + 0x14]
cmp eax, 0x5fde9010
je 0x5fd91528
test byte [eax + 0x1c], 8
jne 0x5fdb50be
cmp dword [ebp + 0xc], 2
jne 0x5fd91537
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and ecx, eax
mov eax, esi
lea edx, [ebp + 0x10]
neg eax
push 4
sbb eax, eax
and eax, 6
push edx
add eax, 4
push eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x5fdb50e6
cmp dword [ebp + 0x18], ebx
je 0x5fd9158a
neg esi
lea eax, [ebp + 0x10]
push 4
sbb esi, esi
push eax
and esi, 6
add esi, 4
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x5fdb5127
test edi, edi
jne 0x5fd91593
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
mov edi, ebx
jmp 0x5fd9158a
push dword [ebp + 0x18]
mov edx, 0x5fd9fd68
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x24
pop ecx
call fcn.5fdce534
push 0x29
pop ecx
jmp 0x5fd91528
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fd9155d
test dword [eax + 0x1c], 0x10000000
je 0x5fd9155d
push edi
push dword [ebp + 8]
mov edx, 0x5fd9fd68
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.5fdc81e7
jmp 0x5fd9155d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov ecx, dword [0x5fde9010]
cmp ecx, 0x5fde9010
je 0x5fd91586
test dword [ecx + 0x1c], 0x10000000
je 0x5fd91586
push ebx
push dword [ebp + 8]
mov edx, 0x5fd9fd68
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x26
pop ecx
call fcn.5fdc81e7
jmp 0x5fd91586
Function at 0x5fd915a0
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
mov ebx, esi
mov dword [ebp - 4], esi
mov eax, dword [0x5fde9010]
mov edi, dword [ebp + 8]
cmp eax, 0x5fde9010
je 0x5fd915c9
test byte [eax + 0x1c], 8
jne 0x5fdb516a
test edi, edi
je 0x5fd91642
cmp edi, 0xffffffff
je 0x5fd91642
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x5fd91642
cmp dword [ebp + 0xc], 2
jne 0x5fd915e8
cmp dword [ebp + 0x10], ebx
je 0x5fdb518c
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 9
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x5fdb51a4
cmp dword [ebp + 0x10], esi
je 0x5fd91633
push dword [ebp + 0x14]
call dword [sym.imp.WS2_32.dll_htonl]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 9
push esi
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x5fdb51e5
test ebx, ebx
jne 0x5fd9163e
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, esi
jmp 0x5fd91633
push 0x57
pop eax
jmp 0x5fd91635
push dword [ebp + 0x14]
mov edx, 0x5fd9fd68
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1d
pop ecx
call fcn.5fdce4f9
jmp 0x5fd915c9
push eax
call dword [sym.imp.WS2_32.dll_htonl]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 9
push esi
jmp 0x5fd915f5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov ecx, dword [0x5fde9010]
cmp ecx, 0x5fde9010
je 0x5fd91605
test dword [ecx + 0x1c], 0x10000000
je 0x5fd91605
push ebx
push edi
push dword [ecx + 0x14]
mov edx, 0x5fd9fd68
push dword [ecx + 0x10]
push 0x1e
pop ecx
call fcn.5fdc81e7
jmp 0x5fd91605
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov ecx, dword [0x5fde9010]
cmp ecx, 0x5fde9010
je 0x5fd9162f
test dword [ecx + 0x1c], 0x10000000
je 0x5fd9162f
push esi
push edi
push dword [ecx + 0x14]
mov edx, 0x5fd9fd68
push dword [ecx + 0x10]
push 0x1f
pop ecx
call fcn.5fdc81e7
jmp 0x5fd9162f
Function at 0x5fd9497f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0x20019
xor esi, esi
push esi
push 0x5fd95d30
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x5fd949cd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x5fd949ec
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp dword [ebp - 4], 0
pop esi
je 0x5fd949dd
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], eax
setne al
mov esp, ebp
pop ebp
ret
Function at 0x5fd95560
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push esi
mov eax, 0x5fde9a18
xor esi, esi
cmp dword [eax], ecx
je 0x5fd95581
add esi, 0xc
add eax, 0xc
cmp esi, 0xcc
jb 0x5fd9556a
jmp 0x5fdad55d
test edx, edx
je 0x5fd95593
cmp byte [eax + 8], 0
je 0x5fdad55d
pop esi
ret 4
cmp byte [eax + 9], 0
je 0x5fd9558f
jmp 0x5fdad55d
push 0x57
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
xor eax, eax
jmp 0x5fd9558f

Function at 0x5fd958c7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
imul eax, edx, 0xc
push ebx
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
mov ebx, dword [eax + 0x5fdea240]
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
push eax
push ecx
push ebx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x5fd959b3
mov eax, dword [ebp - 8]
cmp dword [ebp + 0xc], eax
jne 0x5fdb494e
push esi
test eax, eax
je 0x5fdad3a3
cmp eax, 3
ja 0x5fda07de
mov ecx, dword [ebp - 4]
cmp ecx, 4
jbe 0x5fd95bb2
call fcn.5fd85d21
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x5fdad39c
and dword [esi], 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push ebx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x5fd9a207
mov eax, dword [ebp - 8]
test eax, eax
je 0x5fda1607
cmp eax, 2
ja 0x5fda15fd
test byte [ebp + 8], 0x10
mov ecx, dword [ebp - 4]
jne 0x5fd9a1f7
test ecx, ecx
je 0x5fda160f
mov eax, ecx
shr eax, 1
dec eax
js 0x5fd95996
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, dword [ebp - 4]
test byte [ebp + 8], 1
jne 0x5fdb4966
cmp dword [ebp + 0xc], 4
je 0x5fd959ab
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 4
pop ecx
mov dword [ebp - 4], ecx
jmp 0x5fd9592b
test ecx, ecx
je 0x5fd9a204
cmp dword [esi], 0
jne 0x5fd9597e
push 0xd
pop edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
and dword [eax], 0
mov eax, dword [ebp + 0x14]
and dword [eax], 0
call fcn.5fd83e2e
jmp 0x5fd959b0
cmp eax, 4
jne 0x5fdb4958
mov esi, dword [ebp + 0x10]
jmp 0x5fd95940
cmp eax, 7
jne 0x5fda1607
jmp 0x5fd95971
mov ecx, dword [ebp - 4]
jmp 0x5fd959a0
and dword [esi], 0
jmp 0x5fd95993
push 0xe
jmp 0x5fdb49aa
push 0x57
jmp 0x5fdb49aa
mov eax, 0x3f2
jmp 0x5fd959b3
cmp eax, 7
jne 0x5fdad3a3
jmp 0x5fd9591f
add ecx, ecx
call fcn.5fd85d21
mov ebx, eax
test ebx, ebx
jne 0x5fdb497a
push 0xe
jmp 0x5fd9a206
mov edx, dword [ebp - 4]
mov ecx, esi
lea eax, [edx + edx]
shr edx, 1
push eax
push ebx
call fcn.5fdded46
test eax, eax
jne 0x5fdb499b
mov ecx, ebx
call fcn.5fd83e2e
jmp 0x5fd9a204
mov ecx, dword [ebp - 0xc]
call fcn.5fd83e2e
mov esi, ebx
jmp 0x5fda1607
pop eax
jmp 0x5fd959b2
Function at 0x5fd98589
Capabilities:
Initialize winsock library

Disassembly:
mov ecx, dword [ebx]
test ecx, ecx
je 0x5fd986f2
call fcn.5fd85603
and dword [ebx], 0
jmp 0x5fd986f2
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x5fde94a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
inc eax
mov word [ebp - 0x19a], dx
push edi
mov edi, eax
mov dword [ebp - 0x1a4], eax
lea eax, [ebp - 0x198]
mov dword [ebp - 0x1a0], ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
test esi, esi
jne 0x5fd94c99
push 6
push edi
push 2
mov esi, 0x251d
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
je 0x5fd9870c
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 6
push 1
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
je 0x5fdad6cb
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
je 0x5fdad6d7
cmp dword [ebp + 8], 0
je 0x5fdad692
and dword [ebp - 0x1b4], 0
lea esi, [ebp - 0x1b4]
and dword [ebp - 0x1b0], 0
sub esp, 0x10
mov ecx, dword [ebp - 0x1a0]
mov edi, esp
mov dword [ebp - 0x1ac], 0xffff0000
mov edx, 0x4b0
mov dword [ebp - 0x1a8], 0x100007f
push 1
movsd dword es:[edi], dword [esi]
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.5fd98168
mov ecx, eax
test ecx, ecx
je 0x5fd98707
mov di, word [ebp - 0x19a]
mov eax, dword [ebx]
xor esi, esi
mov dword [ecx], eax
mov dword [ebx], ecx
xor eax, eax
inc eax
cmp di, 0x1c
jne 0x5fd986e4
cmp dword [ebp - 0x1a4], 0
je 0x5fd986e4
and dword [ebp - 0x1b4], 0
lea esi, [ebp - 0x1b4]
and dword [ebp - 0x1b0], 0
sub esp, 0x10
and dword [ebp - 0x1ac], 0
mov edi, esp
mov ecx, dword [ebp - 0x1a0]
mov edx, 0x4b0
mov dword [ebp - 0x1a8], 0x1000000
push eax
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.5fd98168
mov ecx, eax
test ecx, ecx
je 0x5fd98707
mov eax, dword [ebx]
xor esi, esi
mov dword [ecx], eax
mov dword [ebx], ecx
call dword [sym.imp.WS2_32.dll_WSACleanup]
test esi, esi
jne 0x5fd94c99
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5fd83560
mov esp, ebp
pop ebp
ret 8
push 0xe
pop esi
jmp 0x5fd986e4
xor edi, edi
jmp 0x5fd985f8
mov di, word [ebp - 0x19a]
xor eax, eax
inc eax
cmp di, ax
jne 0x5fd98687
push eax
push ecx
mov ecx, dword [ebp - 0x1a0]
mov edx, 0x100007f
push 0x4b0
call fcn.5fd9d628
mov ecx, eax
test ecx, ecx
je 0x5fd98707
jmp 0x5fd9867c
and dword [ebp - 0x1a4], 0
jmp 0x5fd98614
mov di, word [ebp - 0x19a]
jmp 0x5fd98684
Function at 0x5fd9a67e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
mov ebx, 0x20019
mov dword [ebp - 8], edi
push ebx
push edi
push 0x5fd99fd0
push reloc.WS2_32.dll_bind
mov esi, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x5fd9a6ce
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x5fdae07d
mov edx, eax
mov ecx, 0x5fd9a718
call fcn.5fd9a75d
cmp dword [ebp - 4], edi
jne 0x5fd9a709
cmp dword [ebp - 8], edi
je 0x5fd9a6ed
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor eax, eax
test ecx, ecx
setne al
cmp dword [esi + 0x58], eax
jne 0x5fdae0a4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x5fd9a6df
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x5fdae258
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
jmp 0x5fd9a6da
xor edi, edi
xor eax, eax
inc edi
test ecx, ecx
setne al
mov dword [esi + 0x58], eax
test eax, eax
je 0x5fdae0c1
or dword [esi + 0x28], 0x10000000
jmp 0x5fd9a700
and dword [esi + 0x28], 0xefffffff
jmp 0x5fd9a700
Function at 0x5fd9b140
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5fde94a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x123]
push edi
push 0x11c
push 0
push eax
mov byte [ebp - 0x124], 0
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov ebx, dword [esi + 4]
add esp, 0xc
xor edi, edi
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fd9b196
test dword [eax + 0x1c], 0x20000
jne 0x5fdc3103
lea eax, [esi + 0xb8]
mov dword [esi + 0x890], 0x3e8
mov dword [esi + 0x894], eax
mov dword [esi + 0x898], eax
mov dword [esi + 0x89c], eax
mov dword [esi + 0x8a0], eax
xor eax, eax
mov dword [esi + 0x8a4], eax
cmp dword [esi], eax
jne 0x5fdc311b
test ebx, ebx
je 0x5fd9b201
push 6
push ebx
push 0x5fd9b28c
call sub.api_ms_win_core_crt_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
je 0x5fd9b201
push 0xa
push ebx
push 0x5fd9b294
call sub.api_ms_win_core_crt_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x5fdc312b
xor edi, edi
inc edi
push 0x104
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemDirectoryA]
mov ebx, 0x11c
lea ecx, [ebp - 0x124]
push 0x5fd9b2a0
mov edx, ebx
call fcn.5fd9b2be
test edi, edi
je 0x5fd9b240
push 0x5fd9b2b4
mov edx, ebx
lea ecx, [ebp - 0x124]
call fcn.5fd9b2be
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push closesocket
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x5fd9b265
and dword [esi], 0
cmp dword [esi], 0
je 0x5fd9b598
mov ecx, esi
call fcn.5fd9b5bf
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5fd83560
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x5fd9b5a3
xor eax, eax
jmp 0x5fd9b278
push ecx
call fcn.5fdce956
jmp 0x5fd9b59c
push dword [eax + 0x14]
mov edx, 0x5fdbd960
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.5fdc44b5
jmp 0x5fd9b196
push eax
push eax
push eax
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
jmp 0x5fd9b265
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fd9b265
test dword [eax + 0x1c], 0x400
je 0x5fd9b265
push ebx
push dword [eax + 0x14]
mov edx, 0x5fdbd960
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.5fdc7fde
jmp 0x5fd9b265
Function at 0x5fd9b5bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov ebx, dword [esi + 0x20]
mov edi, dword [esi + 0x89c]
test ebx, ebx
jne 0x5fd9b62f
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
lea eax, [esi + 0xb8]
push eax
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
je 0x5fd9b651
mov eax, dword [ebp - 4]
test eax, eax
je 0x5fd9b651
mov cl, byte [edi]
cmp cl, 0xff
je 0x5fd9b639
cmp cl, 0xfe
je 0x5fd9b645
cmp cl, 0xef
je 0x5fdc316d
xor ebx, ebx
inc ebx
xor ecx, ecx
mov dword [esi + 0x20], ebx
test ecx, ecx
jne 0x5fdc31bc
add eax, 0xb8
add eax, esi
mov dword [esi + 0x898], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 1], 0xfe
je 0x5fdad580
jmp 0x5fd9b604
cmp byte [edi + 1], 0xff
je 0x5fdad587
jmp 0x5fd9b609
xor eax, eax
jmp 0x5fd9b632
push 2
jmp 0x5fdc3161
push 3
jmp 0x5fdc3161
xor ecx, ecx
add edi, 2
pop ebx
inc ecx
jmp 0x5fd9b617
cmp byte [edi + 1], 0xbb
jne 0x5fd9b612
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [esi + 0xba]
push eax
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
je 0x5fd9b651
mov eax, dword [ebp - 4]
test eax, eax
je 0x5fd9b651
add eax, 2
xor ecx, ecx
cmp byte [edi + 2], 0xbf
jne 0x5fdc31b4
push 4
pop ebx
inc ecx
add edi, 3
jmp 0x5fd9b617
mov dword [esi + 0x890], 0x7d0
mov dword [esi + 0x894], edi
mov dword [esi + 0x898], edi
mov dword [esi + 0x89c], edi
mov dword [esi + 0x8a0], edi
jmp 0x5fd9b62f