joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55e810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x10]
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x30], ecx
mov ebx, dword [ebp + 0xc]
test eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], edi
js 0x55e9d0
jne 0x55e9d0
test ebx, ebx
je 0x55e898
mov edx, dword [ecx + 0x60]
test edx, edx
je 0x55e8e0
xor esi, esi
xor edi, edi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ebx
mov eax, esi
mov dword [esp + 0xc], edx
add eax, dword [ebp + 8]
mov edx, dword [ebp - 0x30]
mov dword [esp + 4], 1
xor ebx, ebx
sub edx, esi
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fwrite
add esi, eax
adc edi, ebx
test eax, eax
je 0x55e8c0
cmp dword [ebp - 0x2c], edi
jge 0x55e8b1
mov eax, dword [ebp - 0x38]
mov ebx, esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], eax
mov eax, edi
or eax, ebx
je 0x55e970
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
and dword [eax + 0x28], 0xffdfffff
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
jg 0x55e8b8
cmp dword [ebp - 0x30], esi
jbe 0x55e883
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x60]
jmp 0x55e852
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x55e883
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x60]
jmp 0x55e852
mov ecx, dword [ecx + 0x78]
cmp ecx, 0xffffffff
je 0x55e970
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], ebx
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], 0
xor edi, edi
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, esi
sbb edx, edi
cmp edx, 0
ja 0x55e916
cmp eax, 0x7ffffffe
jbe 0x55e91b
mov eax, 0x7fffffff
mov dword [esp + 8], eax
lea eax, [ebx + esi]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__write_1]
test eax, eax
jle 0x55e960
cdq
add esi, eax
adc edi, edx
cmp dword [ebp - 0x2c], edi
jge 0x55e950
mov ebx, esi
mov dword [ebp - 0x2c], edi
jmp 0x55e898
jg 0x55e957
cmp dword [ebp - 0x40], esi
jbe 0x55e93d
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x78]
jmp 0x55e900
mov ebx, esi
mov dword [ebp - 0x2c], edi
mov eax, edi
jmp 0x55e890
lea ebx, [ebp - 0x1c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call fcn.004d8060
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x1c
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 4], ebx
sete al
movzx eax, al
lea eax, [eax + eax + 2]
mov dword [esp], eax
call fcn.00553fe0
mov eax, dword [ebp - 0x1c]
sub esp, 8
mov edx, dword [eax]
test edx, edx
je 0x55ea00
cmp edx, 0xffffffff
je 0x55e9c0
lock sub dword [eax], 1
mov eax, dword [ebp - 0x1c]
je 0x55ea00
nop
mov eax, 0xffffffff
mov edx, 0xffffffff
jmp 0x55e8a7
lea ebx, [ebp - 0x1c]
mov dword [esp + 4], 0x16
mov dword [esp], ebx
call fcn.004d8060
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 4], ebx
mov dword [esp], 2
call fcn.00553fe0
jmp 0x55e9a5
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
jmp 0x55e9c0
Function at 0x561890
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x20]
mov ebx, ecx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0x100c
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub esp, 0x10
test eax, eax
je 0x561942
lea edi, [ebp - 0x24]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.005b01a0
mov dword [esp + 4], 0xa
mov dword [esp], 0
mov ecx, edi
call fcn.00665f40
sub esp, 8
add eax, 1
mov ecx, ebx
mov dword [esp], eax
call fcn.005cfcf0
mov eax, dword [ebp - 0x24]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x56191e
cmp edx, 0xffffffff
je 0x561953
lock sub dword [eax], 1
mov eax, dword [ebp - 0x24]
jne 0x561953
mov dword [esp], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 2
call fcn.004a4c50
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp], 1
mov ecx, ebx
call fcn.005cfbe0
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x5633b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x1c]
mov ebx, ecx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 2
mov dword [esp + 8], esi
mov dword [esp + 4], 0xd
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub esp, 0x10
test eax, eax
je 0x563491
lea edi, [ebp - 0x20]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.005b01a0
mov dword [esp], 1
mov dword [esp + 4], 0x74308a
mov ecx, edi
call fcn.00667b90
sub esp, 8
test al, al
je 0x563470
mov dword [esp], 1
mov ecx, ebx
call fcn.005cfbe0
mov eax, dword [ebp - 0x20]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x563447
cmp edx, 0xffffffff
je 0x5634a2
lock sub dword [eax], 1
mov eax, dword [ebp - 0x20]
jne 0x5634a2
mov dword [esp], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 2
call fcn.004a4c50
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
test edx, edx
jne 0x5634b0
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
mov dword [esp], 0
mov ecx, ebx
call fcn.005cfbe0
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4
cmp edx, 0xffffffff
je 0x563491
lock sub dword [eax], 1
mov eax, dword [ebp - 0x20]
jne 0x563491
jmp 0x563479
Function at 0x5640f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, ecx
lea ecx, [ebp - 0x260]
lea edi, [ebp - 0x216]
sub esp, 0x27c
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x260], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x25c], eax
call fcn.00656b40
lea ecx, [ebp - 0x260]
mov word [ebp - 0x24c], ax
call fcn.00656c30
lea ecx, [ebp - 0x260]
mov word [ebp - 0x24a], ax
call fcn.00656a50
mov edx, dword [ebp + 0x14]
mov word [ebp - 0x246], ax
xor eax, eax
mov dword [esp + 0x14], 0xff
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
test edx, edx
lea edx, [ebp - 0x24c]
sete al
add eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
sub esp, 0x18
test eax, eax
je 0x564244
lea eax, [ebp - 0x250]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.005b01a0
mov eax, dword [ebx + 4]
test eax, eax
je 0x564290
cmp eax, 2
je 0x564330
lea eax, [ebp - 0x250]
mov ecx, esi
mov dword [esp], eax
call fcn.005cfa30
mov eax, dword [ebp - 0x250]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x564220
cmp edx, 0xffffffff
je 0x564238
lock sub dword [eax], 1
mov eax, dword [ebp - 0x250]
jne 0x564238
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea ebx, [ebp - 0x22c]
mov ecx, esi
mov dword [ebp - 0x22c], 0x880f80
mov dword [esp], ebx
call fcn.005cfa30
mov eax, dword [ebp - 0x22c]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x564220
cmp edx, 0xffffffff
je 0x564238
lock sub dword [eax], 1
mov eax, dword [ebp - 0x22c]
je 0x564220
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea eax, [ebp - 0x23c]
mov dword [esp + 0xc], 8
mov dword [esp + 4], 0x1014
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
je 0x564350
movzx eax, word [ebp - 0x23c]
cmp ax, 0x31
je 0x564350
cmp ax, 0x30
je 0x564360
cmp ax, 0x32
je 0x564320
lea eax, [ebp - 0x22c]
mov dword [esp + 0xc], 0xb
mov dword [esp + 4], 0x13
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
je 0x564350
movzx eax, word [ebp - 0x22c]
movzx edx, word [ebp - 0x23c]
add eax, 2
cmp edx, eax
jne 0x564350
mov dword [ebx + 4], 2
mov esi, esi
lea edi, [edi]
lea eax, [ebp - 0x250]
mov ecx, ebx
mov dword [esp], eax
call fcn.00561c70
sub esp, 4
jmp 0x5641ea
mov dword [ebx + 4], 3
jmp 0x5641ea
mov dword [ebx + 4], 1
jmp 0x5641ea
Function at 0x5643a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, ecx
lea ecx, [ebp + 0xc]
lea edi, [ebp - 0x216]
sub esp, 0x26c
mov dword [ebp - 0x24c], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
call fcn.00658d90
lea ecx, [ebp + 0xc]
mov word [ebp - 0x244], ax
call fcn.00658e00
lea ecx, [ebp + 0xc]
mov word [ebp - 0x242], ax
call fcn.00658e40
mov word [ebp - 0x240], ax
xor eax, eax
lea edx, [ebp - 0x24c]
mov word [ebp - 0x23e], ax
xor eax, eax
cmp dword [ebp + 0x10], 1
mov dword [esp + 0x14], 0xff
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
sete al
add eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
sub esp, 0x18
test eax, eax
je 0x5644e4
lea eax, [ebp - 0x250]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.005b01a0
mov eax, dword [ebx + 4]
test eax, eax
je 0x564530
cmp eax, 2
je 0x5645d0
lea eax, [ebp - 0x250]
mov ecx, esi
mov dword [esp], eax
call fcn.005cfa30
mov eax, dword [ebp - 0x250]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x5644c0
cmp edx, 0xffffffff
je 0x5644d8
lock sub dword [eax], 1
mov eax, dword [ebp - 0x250]
jne 0x5644d8
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
lea ebx, [ebp - 0x22c]
mov ecx, esi
mov dword [ebp - 0x22c], 0x880f80
mov dword [esp], ebx
call fcn.005cfa30
mov eax, dword [ebp - 0x22c]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x5644c0
cmp edx, 0xffffffff
je 0x5644d8
lock sub dword [eax], 1
mov eax, dword [ebp - 0x22c]
je 0x5644c0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
lea eax, [ebp - 0x23c]
mov dword [esp + 0xc], 8
mov dword [esp + 4], 0x1014
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
je 0x5645f0
movzx eax, word [ebp - 0x23c]
cmp ax, 0x31
je 0x5645f0
cmp ax, 0x30
je 0x564600
cmp ax, 0x32
je 0x5645c0
lea eax, [ebp - 0x22c]
mov dword [esp + 0xc], 0xb
mov dword [esp + 4], 0x13
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
je 0x5645f0
movzx eax, word [ebp - 0x22c]
movzx edx, word [ebp - 0x23c]
add eax, 2
cmp edx, eax
jne 0x5645f0
mov dword [ebx + 4], 2
mov esi, esi
lea edi, [edi]
lea eax, [ebp - 0x250]
mov ecx, ebx
mov dword [esp], eax
call fcn.00561c70
sub esp, 4
jmp 0x564486
mov dword [ebx + 4], 3
jmp 0x564486
mov dword [ebx + 4], 1
jmp 0x564486
Function at 0x5a77e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x78]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebx, dword [esp + 0x90]
test eax, eax
je 0x5a7944
lea edx, [esp + 0x30]
test ebx, ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
je 0x5a7855
lea ebp, [esp + 0x34]
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov ecx, ebx
mov dword [esp], 0xa
call fcn.00608020
sub esp, 0xc
mov edx, dword [esp + 0x30]
test edx, edx
js 0x5a78c0
mov eax, dword [ebx + 8]
cmp edx, dword [eax + 0x34]
jl 0x5a78d0
mov ebx, dword [ebx]
test ebx, ebx
jne 0x5a78d0
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0x747ab9
call dword [eax]
mov ecx, eax
call fcn.00608ab0
mov dword [esp + 8], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], str.QObject::connect:_signal_not_found_in__s
mov dword [esp], eax
call fcn.0072013c
mov ecx, dword [esp + 0x84]
call fcn.005eca70
mov dword [esi], 0
add esp, 0x5c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [ebx]
test ebx, ebx
jne 0x5a781e
jmp 0x5a7855
mov eax, dword [ebx]
test eax, eax
je 0x5a78ee
xor ecx, ecx
nop
lea esi, [esi]
mov ebp, dword [eax + 8]
mov eax, dword [eax]
add ecx, dword [ebp + 0x34]
test eax, eax
jne 0x5a78e0
add edx, ecx
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x20], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], eax
call fcn.004f3df0
add esp, 0x5c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x3c]
mov dword [esp + 4], str.QObject::connect:_invalid_nullptr_parameter
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp], eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0x747ab9
call fcn.0072013c
cmp dword [esp + 0x84], 0
je 0x5a7996
mov ecx, dword [esp + 0x84]
call fcn.005eca70
mov dword [esi], 0
jmp 0x5a78b4

Function at 0x5ab910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
pop ebx
jmp fcn.004877f0

Function at 0x5b1760
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
mov eax, dword [esp + 0x30]
add esp, 0x4c
ret
Function at 0x5b2220
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, ecx
sub esp, 0x3c
mov ebx, dword [ecx + 4]
mov esi, ebx
add esi, 0x30
je 0x5b2304
mov ecx, esi
call fcn.005a0120
cmp byte [ebx + 0x3a], 0
je 0x5b2270
and esi, 0xfffffffe
mov ecx, esi
call fcn.005a0160
mov dword [esp], 0xffffffff
mov ecx, edi
call fcn.005b1f50
sub esp, 4
test esi, esi
je 0x5b2320
mov ecx, esi
call fcn.005a0120
or esi, 1
cmp byte [ebx + 0x38], 0
je 0x5b2290
mov ecx, esi
and ecx, 0xfffffffe
call fcn.005a0160
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [ebp - 0x1c], 1
mov byte [ebx + 0x38], 1
mov byte [ebx + 0x39], 0
lea eax, [ebx + 0x50]
mov byte [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov byte [ebx + 0x3b], 0
mfence
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4f9fe0
mov eax, dword [ebx + 0x44]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
mov dword [ebx + 0x4c], eax
je 0x5b240c
mov edx, dword [ebp + 8]
cmp edx, 6
mov dword [ebx + 0x48], edx
ja case.default.0x5b22fd
jmp dword [edx*4 + 0x741ec4]
cmp byte [ebx + 0x3a], 0
je 0x5b2320
mov dword [esp], 0xffffffff
call fcn.005b1f50
sub esp, 4
lea esi, [esi]
cmp byte [ebx + 0x38], 0
jne 0x5b2283
mov dword [ebp - 0x1c], 0
xor esi, esi
jmp 0x5b2297
mov edx, 0xfffffffe
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
sub esp, 8
test eax, eax
je 0x5b2440
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
cmp eax, 0xffffffff
je 0x5b242f
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x5b2279
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov edx, 0xf
jmp 0x5b2345
mov edx, 0xfffffff1
jmp 0x5b2345
mov edx, 0xffffffff
jmp 0x5b2345
mov edx, 2
jmp 0x5b2345
xor edx, edx
jmp 0x5b2345
mov edx, 1
jmp 0x5b2345
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edx, eax
sub esp, 4
mov eax, dword [ebx + 0x4c]
jmp 0x5b2345
mov dword [esp], str.QThread::start:_Failed_to_create_thread
call fcn.00720480
cmp dword [ebp - 0x1c], 0
mov byte [ebx + 0x38], 0
mov byte [ebx + 0x39], 1
jne 0x5b2279
jmp 0x5b2283
mov dword [esp], str.QThread::start:_Failed_to_resume_new_thread
call fcn.00720480
jmp 0x5b2375
mov dword [esp], str.QThread::start:_Failed_to_set_thread_priority
call fcn.00720480
jmp 0x5b235d
Function at 0x5b2550
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, ecx
sub esp, 0x2c
mov ebx, dword [ecx + 4]
mov esi, ebx
add esi, 0x30
je 0x5b25e0
mov ecx, esi
call fcn.005a0120
mov eax, esi
or eax, 1
cmp byte [ebx + 0x38], 0
mov dword [ebp - 0x1c], eax
jne 0x5b2590
mov ecx, esi
lea esp, [ebp - 0xc]
and ecx, 0xfffffffe
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.005a0160
cmp byte [ebx + 0x58], 0
jne 0x5b25a0
mov byte [ebx + 0x59], 1
jmp 0x5b257a
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
sub esp, 8
mov ebx, 1
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.004fa1d0
test ebx, ebx
mov ecx, dword [ebp - 0x1c]
jne 0x5b257c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [ebx + 0x38], 0
je 0x5b25d3
cmp byte [ebx + 0x58], 0
jne 0x5b25f2
mov byte [ebx + 0x59], 1
jmp 0x5b25d3
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x4c]
xor ebx, ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 0x1c], 0
sub esp, 8
jmp 0x5b25bc

Function at 0x5cde80
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebx
add esp, 0xffffff80
lea eax, [esp + 0x2c]
mov ebx, dword [esp + 0x90]
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], str.SOFTWAREMicrosoftCryptography
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x5cdee0
mov dword [ebx], 0x880f80
sub esp, 0xffffff80
mov eax, ebx
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x30]
lea esi, [esp + 0x36]
mov dword [esp + 0x30], 0x4a
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], esi
mov dword [esp + 4], str.MachineGuid
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
mov edi, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
test edi, edi
jne 0x5cdec9
mov eax, dword [esp + 0x30]
mov dword [esp + 8], esi
mov dword [esp], ebx
sub eax, 1
shr eax, 1
mov dword [esp + 4], eax
call fcn.005ecab0
jmp 0x5cdecf
Function at 0x5ec920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
pop ebx
jmp fcn.004877f0
Function at 0x5f3180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x80]
mov esi, 0x78c04d
sub esp, 0x9c
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 1]
mov dword [ebp - 0x8c], eax
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x78c0b1]
mov dword [ebp - 0x1c], eax
lea eax, [edx + 0x87]
rep movsd dword es:[edi], dword [esi]
and eax, 0xfffffff0
call fcn.00447e80
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x8c]
mov byte [ebx + eax + 0x67], 0
mov dword [esp], ebx
call fcn.006f7590
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x73e184], 0
jne 0x5f326d
mov byte [0x73e184], 1
call fcn.0070b730
test eax, eax
je 0x5f32b1
mov ebx, dword [eax + 4]
cmp byte [ebx], 0x2a
je 0x5f329f
lea eax, [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
call fcn.00446d90
mov dword [esp], 2
mov edi, eax
mov esi, dword [fcn.00457d50]
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp], 2
je 0x5f325d
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x78b0dd
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
je 0x5f32a7
call fcn.0070bc10
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x5f3228
mov dword [esp], 2
call dword [0x739190]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
add ebx, 1
jmp 0x5f31b3
mov dword [esp], edi
call sub.msvcrt.dll_free
jmp 0x5f3258
mov dword [esp], 2
call dword [0x739190]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
sub edx, 1
mov dword [esp], eax
jne 0x5f3357
call fcn.0070b5a0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov dword [esp], 2
mov ebx, eax
call esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str.__what__:
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
call fcn.0070b790
jmp 0x5f32de
call fcn.0070b5a0
call fcn.0070b790
jmp 0x5f32de