joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b8f10
Capabilities:
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe4
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0xf0]
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
push ecx
mov ecx, ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b82c0
test eax, eax
jl 0x5b90ff
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 4], ebx
je 0x5b90fe
mov ecx, esi
call fcn.005bdec0
cmp eax, 0xffffffff
jne 0x5b90fe
mov ecx, esi
call fcn.005bd160
movzx edx, ax
push 0x5c
lea eax, [ebp + 0xf0e]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], edx
mov edx, dword [ebp + 0x90]
push ecx
push edx
call fcn.005c1800
test eax, eax
jl 0x5b90fe
mov eax, dword [esp + 0x10]
push eax
call fcn.005c13c0
test eax, eax
je 0x5b90fe
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.005c0f20
test eax, eax
jl 0x5b90fe
mov edx, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x74]
push ecx
push ebx
push edx
xor esi, esi
mov dword [esp + 0x3c], 0x5a
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x5b90f4
push edi
jmp 0x5b8ff0
inc esi
cmp eax, ebx
mov dword [esp + 0x24], esi
jne 0x5b90ce
mov eax, dword [ebp + 0x90]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.005b7ba0
push 0x32
lea edx, [esp + 0xc4]
push edx
lea eax, [esp + 0x6c]
push eax
call fcn.005c05c0
test eax, eax
jl 0x5b903f
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.005c4506
add esp, 8
jmp 0x5b9044
mov word [esp + 0x2c], bx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
mov dword [esp + 0x18], ebx
mov esi, 1
call fcn.005b82c0
test eax, eax
jl 0x5b9089
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.005bd160
movzx edx, ax
cmp edx, dword [esp + 0x28]
je 0x5b9078
xor esi, esi
cmp edi, ebx
je 0x5b9085
push edi
call fcn.00404b90
add esp, 4
cmp esi, ebx
je 0x5b90c2
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0x2001f
push ebx
lea ecx, [esp + 0x70]
push ecx
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5b90c2
mov eax, dword [esp + 0x10]
push ebx
push eax
call fcn.005c12f0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x20], 0x5a
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x78]
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x5b8ff0
pop edi
mov edx, dword [esp + 0x10]
push edx
call fcn.005c1380
pop esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x5b910e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x5b911d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop ebp
cmp eax, ebx
pop ebx
je 0x5b9130
push eax
call fcn.00404b90
add esp, 4
add esp, 0xe4
ret 4
Function at 0x5ba7c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 4
push 0
push 0
mov esi, ecx
push 0
lea ecx, [esi + 0xd0]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, 0x80070005
call edi
test eax, eax
jne 0x5ba858
push eax
lea edx, [esp + 0x10]
push edx
push eax
push 0x20006
push eax
push eax
push eax
mov eax, dword [esp + 0x2c]
push str.License
push eax
call edi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x5ba851
push 0x16
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.005b9880
mov eax, dword [esp + 0xc]
push 0x16
lea edx, [esp + 0x18]
push edx
push 1
push 0
push str.LastValidMachineCode
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x5ba84a
xor ebx, ebx
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret

Function at 0x5ba870
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 0x20019
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [esi + 0xd0]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0x16
call edi
test eax, eax
jne 0x5ba91c
lea edx, [esp + 0xc]
push edx
push 0x20019
push eax
mov eax, dword [esp + 0x1c]
push str.License
push eax
call edi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x5ba915
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push str.LastValidMachineCode
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5ba90e
push 0x16
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.005b9880
push 8
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00462850
test eax, eax
je 0x5ba90e
mov ebx, 1
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x3c
ret
Function at 0x5bace0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x428
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [esp + 0x1c]
push eax
push 0x20019
mov ebx, ecx
xor edi, edi
push edi
lea ecx, [ebx + 0xd0]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x208
mov dword [esp + 0x28], 0x32
call esi
test eax, eax
jne 0x5baf0f
lea edx, [esp + 0x10]
push edx
push 0x2001f
push eax
mov eax, dword [esp + 0x28]
push str.License
push eax
call esi
test eax, eax
jne 0x5baf04
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
push edi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x244]
push edx
push edi
push eax
call esi
cmp eax, 0x103
je 0x5baef9
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 3
push 0x5f7084
lea ecx, [esp + 0x238]
push ecx
inc edi
call fcn.00462850
test eax, eax
jne 0x5bae1d
push 1
push 0x5d49c0
lea edx, [esp + 0x30]
push edx
call fcn.00462850
test eax, eax
je 0x5bae1d
lea eax, [esp + 0x28]
push eax
mov ecx, ebx
call fcn.005ba930
test eax, eax
jl 0x5bae04
mov ecx, dword [esp + 0x43c]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.005c44fa
add esp, 8
test eax, eax
je 0x5bae04
lea eax, [esp + 0x24]
push eax
mov ecx, ebx
call fcn.005bab30
test eax, eax
jge 0x5baea3
mov eax, dword [ebx]
test eax, eax
je 0x5baea3
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x5baea3
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x230]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
dec edi
jmp 0x5bae9b
push 1
push 0x5d49c0
lea eax, [esp + 0x238]
push eax
call fcn.00462850
test eax, eax
jne 0x5baea3
push 1
push 0x5d49c0
lea ecx, [esp + 0x30]
push ecx
call fcn.00462850
test eax, eax
je 0x5baea3
lea edx, [esp + 0x28]
push edx
mov ecx, ebx
call fcn.005ba930
test eax, eax
jl 0x5bae83
mov eax, dword [esp + 0x43c]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.005c44fa
add esp, 8
test eax, eax
je 0x5bae83
lea edx, [esp + 0x24]
push edx
mov ecx, ebx
call fcn.005bab30
test eax, eax
jl 0x5baea3
mov edx, dword [esp + 0x10]
push 0x30
lea eax, [esp + 0x234]
push eax
push 1
push 0
mov ecx, eax
push ecx
push edx
call ebp
test eax, eax
jl 0x5baf22
lea eax, [esp + 0x230]
push 0x5d49c0
push eax
mov dword [esp + 0x20], 0x208
mov dword [esp + 0x1c], 0x32
call fcn.005c43d6
add esp, 8
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x244]
push edx
push edi
push eax
call esi
cmp eax, 0x103
jne 0x5bad80
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5d49c0
add ebx, 4
push ebx
call fcn.005c43d6
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x428
ret 4
Function at 0x5bb420
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x288
push ebx
mov ebx, dword [esp + 0x290]
push ebp
push esi
push edi
xor edi, edi
push ebx
mov esi, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], 0x32
mov ebp, 0x8004e142
mov dword [esp + 0x18], edi
call fcn.005bace0
test eax, eax
jne 0x5bb636
push edi
lea eax, [esp + 0x1c]
push eax
push edi
push 4
push edi
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [esi + 0xd0]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x5bb636
push eax
lea edx, [esp + 0x14]
push edx
push eax
push 0x2001f
push eax
push eax
push eax
mov eax, dword [esp + 0x34]
push str.License
push eax
call edi
test eax, eax
jne 0x5bb62b
mov ecx, dword [esi]
test ecx, ecx
je 0x5bb4f1
push 0x19
lea edx, [esp + 0x60]
push edx
call fcn.005bd180
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.005c44fa
add esp, 8
test eax, eax
jne 0x5bb4dc
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov dword [esp + 0x14], edx
xor ebp, ebp
jmp 0x5bb50a
mov eax, dword [esi]
test eax, eax
je 0x5bb4eb
push eax
call fcn.00404b90
add esp, 4
mov dword [esi], 0
mov ecx, esi
push ebx
call fcn.005ba930
mov ebp, eax
test ebp, ebp
jl 0x5bb620
mov ecx, dword [esi]
call fcn.005be9e0
push ebx
mov ecx, esi
call fcn.005b8f10
lea edx, [esi + 0x44]
xor eax, eax
mov edi, edx
push ebx
mov ecx, 0x10
push edx
rep stosd dword es:[edi], eax
call fcn.005c43d6
mov ecx, dword [esi]
add esp, 8
call fcn.005bdec0
test eax, eax
jl 0x5bb581
cmp eax, 0x3ff
jge 0x5bb549
mov eax, dword [esi]
test eax, eax
je 0x5bb581
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x5bb581
lea eax, [esp + 0x90]
push str.keyTrial
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push ebx
call fcn.004049f0
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push ecx
push ebx
push 1
push 0
lea edx, [esp + 0xa0]
push edx
push eax
jmp 0x5bb605
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esp + 0x20]
inc eax
push eax
lea ecx, [esp + 0x94]
push str.key_d
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0x32
call edi
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
push ecx
push 0
lea edx, [esp + 0xa0]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5bb5e8
push 1
push 0x5d49c0
lea ecx, [esp + 0x30]
push ecx
call fcn.00462850
test eax, eax
jne 0x5bb587
push ebx
call fcn.004049f0
mov ecx, dword [esp + 0x10]
lea edx, [eax + eax + 2]
push edx
push ebx
push 1
push 0
lea eax, [esp + 0xa0]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x5bb620
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5bb61e
mov ecx, esi
call fcn.005ba7c0
xor ebp, ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x288
ret 4
Function at 0x5bb830
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x9c
push ebp
mov eax, 0x32
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
cmp dword [esi + 0xf88], ebp
push edi
mov dword [esp + 0x24], 1
mov edi, 0x80070005
mov dword [esp + 0x10], ebp
je 0x5bb9f2
mov ecx, dword [esi + 0x90]
push ebx
push 7
lea eax, [esp + 0x38]
push eax
push ecx
call fcn.005c26c0
mov dx, word [esp + 0x3e]
mov ax, word [esp + 0x40]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
mov word [esp + 0x34], dx
push ebp
lea edx, [esi + 0x8e0]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x42], ax
mov word [esp + 0x44], bp
call ebx
test eax, eax
jne 0x5bb9e2
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0x2001f
push ebp
lea ecx, [esp + 0x38]
push ecx
push edx
call ebx
test eax, eax
jne 0x5bb9d7
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x1c]
xor ebx, ebx
push ebx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x8c]
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x5bb9cc
push 1
push 0x5d49c0
lea eax, [esp + 0x80]
push eax
call fcn.00462850
test eax, eax
je 0x5bb9ef
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x48]
push edx
mov ecx, esi
call fcn.005b82c0
mov edi, eax
cmp edi, ebx
jl 0x5bb9ef
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.005bb420
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x78]
push ecx
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp edi, ebx
jl 0x5bb971
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x5bb986
push eax
call fcn.00404b90
add esp, 4
mov dword [esp + 0x20], ebx
dec ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x8c]
push ecx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x5bb910
cmp dword [esp + 0x14], 1
jne 0x5bb9cc
push ebx
push 2
mov ecx, esi
call fcn.005bbf70
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x9c
ret
inc ebp
jmp 0x5bb987
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x9c
ret
Function at 0x5bba00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor eax, eax
mov ecx, 0xd
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
push 0x32
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov ebx, 0x8004e12d
mov dword [esp + 0x18], 0x34
mov ebp, 0x80004005
mov word [esp + 0x2c], 0
call fcn.005b5d90
test eax, eax
jl 0x5bba70
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.005bb420
mov ecx, esi
call fcn.005b5e20
push 0
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.005b9ff0
mov ebp, eax
mov ecx, esi
call fcn.005bb830
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
lea eax, [esi + 0xd0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x5bbb85
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push eax
push str.License
push edx
call edi
test eax, eax
jne 0x5bbb33
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x5c]
push ecx
push 0
push 0
push str.CurrentKey
push edx
call edi
test eax, eax
je 0x5bbaeb
push 0
push 2
mov ecx, esi
call fcn.005bbf70
jmp 0x5bbb00
test ebp, ebp
jl 0x5bbb26
push 0
push 2
mov ecx, esi
call fcn.005bbf70
mov ebx, eax
test ebx, ebx
jl 0x5bbb28
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x5c]
push ecx
push 0
push 0
push str.CurrentKey
push edx
mov dword [esp + 0x28], 0x34
call edi
test eax, eax
jne 0x5bbb28
xor ebx, ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jl 0x5bbb85
mov edi, dword [esp + 0x94]
shr edi, 1
test edi, edi
jle 0x5bbb6c
mov ebp, dword [esp + 0x90]
push edi
lea edx, [esp + 0x5c]
push edx
push ebp
call fcn.005c43dc
add esp, 0xc
mov word [ebp + edi*2 - 2], 0
push 0x20
lea eax, [esp + 0x5c]
push eax
add esi, 4
push esi
call fcn.005c43dc
add esp, 0xc
mov word [esi + 0x3e], 0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x7c
ret 8
Function at 0x5bbf70
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x34
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x40]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.005bbba0
mov edi, eax
test edi, edi
jl 0x5bc007
lea eax, [esp + 0x40]
push eax
push 0x20006
push 0
add esi, 0xd0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x5bc007
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x44]
push ecx
push 0x20006
push eax
push str.License
push edx
call esi
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x5bc000
mov ecx, dword [esp + 0x44]
push 0x32
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.CurrentKey
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x5bbff9
xor edi, edi
mov edx, dword [esp + 0x44]
push edx
call esi
mov eax, dword [esp + 0x40]
push eax
call esi
mov eax, edi
pop edi
pop esi
add esp, 0x34
ret 8
Function at 0x5becf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebx
or ebx, 0xffffffff
sub ebx, ecx
test eax, eax
push esi
mov esi, dword [esp + 0xc]
jne 0x5bed0e
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
mov cx, word [esi]
test cx, cx
je 0x5bed4f
movzx edx, byte [esi]
movzx eax, bl
xor edx, eax
mov eax, ebx
mov ebx, dword [edx*4 + 0x5f7fc0]
shr eax, 8
xor eax, ebx
movzx edx, al
movzx ecx, ch
xor ecx, edx
mov edx, dword [ecx*4 + 0x5f7fc0]
add esi, 2
shr eax, 8
xor ecx, ecx
mov cx, word [esi]
xor eax, edx
test cx, cx
mov ebx, eax
jne 0x5bed16
pop esi
mov eax, ebx
pop ebx
ret 0xc

Function at 0x5bed60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
push ebp
mov ebp, dword [esp + 8]
jne 0x5bed74
push ebp
call dword [sym.imp.USER32.dll_CharUpperW]
test ebp, ebp
je 0x5bee18
push ebx
push ebp
call fcn.005c43e2
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x5bee05
push edi
inc ebx
lea eax, [ebx + ebx]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x5bee0e
push esi
push ebx
push ebp
push edi
mov esi, edi
call fcn.00461300
test eax, eax
je 0x5bedde
mov al, byte [edi]
test al, al
je 0x5bedde
mov ebx, dword [esp + 0x18]
movzx edx, bl
movzx ecx, al
mov al, byte [esi + 1]
xor ecx, edx
mov ebp, dword [ecx*4 + 0x5f7fc0]
shr ebx, 8
xor ebx, ebp
inc esi
test al, al
jne 0x5bedc0
jmp 0x5bede2
mov ebx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
mov eax, dword [esp + 0x10]
pop ebx
pop ebp
ret 0xc
mov eax, dword [esp + 0x14]
pop edi
pop ebx
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
pop ebp
ret 0xc
Function at 0x5bf150
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x42c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push edi
push ebx
call fcn.005bf0a0
test eax, eax
mov dword [esp + 0x14], eax
je 0x5bf1f3
lea eax, [esp + 0x10]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x5bf225
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jbe 0x5bf1e8
mov eax, 0x104
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x238]
push eax
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x5bf1e8
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x28]
push ecx
push edx
call fcn.005bf150
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jb 0x5bf195
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [esp + 0x10]
push ecx
push edi
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x5bf21e
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5bf165
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5c1080
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
sub esp, 0x10c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebp
mov ebp, dword [esp + 0x124]
push esi
mov esi, dword [esp + 0x120]
push edi
mov edi, dword [esp + 0x120]
push eax
push ebp
push ecx
push 0
push esi
push edi
call ebx
test eax, eax
je 0x5c10cc
pop edi
pop esi
pop ebp
mov eax, 0x80070005
pop ebx
add esp, 0x10c
ret 0x14
lea edx, [esp + 0x1c]
push esi
push edx
call fcn.005c43d6
lea eax, [esp + 0x24]
push 0x5eac64
push eax
call fcn.005c4506
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x2c]
push ecx
mov esi, 4
push edi
mov dword [esp + 0x30], esi
call ebx
test eax, eax
je 0x5c1121
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x10c
ret 0x14
cmp dword [esp + 0x10], esi
jne 0x5c110f
mov edx, dword [esp + 0x128]
cmp dword [edx], 1
jne 0x5c1142
push 1
push 0xdfd7b6a4
push ebp
call fcn.005becf0
jmp 0x5c1151
movzx eax, byte [ebp]
push 0xdfd7b6a4
push eax
call fcn.005bee20
mov esi, dword [esp + 0x14]
xor ecx, ecx
cmp esi, eax
sete cl
pop edi
pop esi
pop ebp
pop ebx
dec ecx
and ecx, 0x80070057
mov eax, ecx
add esp, 0x10c
ret 0x14

Function at 0x5c1180
Capabilities:
Set registry value

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x114]
cmp esi, 1
je 0x5c11ac
cmp esi, 2
jbe 0x5c119d
cmp esi, 4
jbe 0x5c11ac
mov eax, 0x80070057
pop esi
add esp, 0x104
ret 0x14
mov eax, dword [esp + 0x11c]
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x11c]
push eax
push ebx
push esi
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x5c11ee
pop edi
pop ebp
pop ebx
mov eax, 0x80070005
pop esi
add esp, 0x104
ret 0x14
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.005c43d6
lea edx, [esp + 0x1c]
push 0x5eac64
push edx
call fcn.005c4506
add esp, 0x10
cmp esi, 1
jne 0x5c121e
push esi
push 0xdfd7b6a4
push ebx
call fcn.005becf0
jmp 0x5c122c
movzx eax, byte [ebx]
push 0xdfd7b6a4
push eax
call fcn.005bee20
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
lea edx, [esp + 0x24]
push edx
push ebp
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
neg eax
pop ebp
sbb eax, eax
pop ebx
and eax, 0x80070005
pop esi
add esp, 0x104
ret 0x14