joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53ca90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59166e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
push eax
mov esi, ecx
push 0
mov dword [esp + 0x1c], esi
call fcn.00537980
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x30]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x14], edx
mov dx, word [esp + 0x48]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x54]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x5c]
mov word [esi + 0x28], dx
mov edx, dword [esp + 0x50]
push ebx
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x50]
push edx
mov dword [esi + 0x30], ecx
push eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x2c], 0
mov dword [esi], 0x5c79dc
mov dword [esi + 0xc], 0x5c79c0
call fcn.0053c210
lea edi, [esi + 0x48]
mov dword [edi], 0
fld qword [esp + 0x38]
fmul qword [0x59d190]
mov byte [esp + 0x20], 2
mov dword [esi + 0x4c], 0x80004004
call fcn.00558260
mov ecx, dword [esi + 0x20]
lea ebp, [esp + 0x10]
push ebp
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
push ecx
mov dword [esi + 0x1c], edx
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x53cc81
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [esp + 0x34]
test edx, edx
mov dword [esp + 0x34], 0
jne 0x53cb86
mov eax, 0x80004003
mov dword [ebx], eax
jmp 0x53cc57
cmp dword [edi], 0
jne 0x53cc12
call fcn.00537880
mov ebx, eax
test ebx, ebx
je 0x53cc6e
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadRegTypeLib
push ebx
call ebp
test eax, eax
je 0x53cc6e
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 1
push 0x5c5c98
call eax
test eax, eax
jge 0x53cbee
push str.LoadTypeLib
push ebx
call ebp
test eax, eax
je 0x53cc6e
lea edx, [esp + 0x2c]
push edx
push 0x5c798c
call eax
test eax, eax
jl 0x53cc7d
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push edi
push edx
push eax
call dword [ecx + 0x18]
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test ebx, ebx
jge 0x53cc12
mov eax, ebx
jmp 0x53cc79
mov edi, dword [edi]
mov edx, dword [edi]
push edi
mov dword [esp + 0x38], edi
call dword [edx + 4]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp word [esp + 0x48], 4
jne 0x53cc43
lea eax, [esi + 0x44]
mov dword [esi + 0x40], 1
mov dword [eax], 0xfffffffd
mov dword [esi + 0x38], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
push esi
call dword [edx + 8]
test eax, eax
jge 0x53cc57
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x38
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x80070000
test eax, eax
jge 0x53cc1e
mov ebx, dword [esp + 0x30]
mov dword [ebx], eax
jmp 0x53cc57
Function at 0x53da30
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 8]
push ecx
push edx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esi + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
cmp edi, 1
jne 0x53da8b
mov eax, dword [esi + 0x1c]
push 0x77
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
mov ebx, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x14]
push 1
push ecx
sub edx, ebx
push edx
push 1
call edi
push eax
push 0
call edi
mov edi, dword [sym.imp.USER32.dll_MoveWindow]
push eax
mov eax, dword [esi + 0x1c]
push eax
call edi
mov ecx, dword [esi + 0x1c]
push 0x77
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi + 0x1c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push eax
call ebx
test eax, eax
je 0x53db08
mov edx, dword [esi + 0x1c]
push 2
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x14]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x1c]
push ecx
push eax
call edi
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x540d30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x18]
test eax, eax
jne 0x540d3d
mov eax, 1
ret
mov eax, dword [ecx + 8]
push 0
push eax
mov dword [ecx + 0x18], 0
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret

Function at 0x540fb0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
Function at 0x542120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x591c58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
xor ebx, ebx
test eax, eax
je 0x5421b9
mov ecx, dword [esi + 8]
push ebp
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebp, eax
pop ebp
jne 0x5421b9
mov edi, dword [esi + 8]
cmp edi, ebx
je 0x542238
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov eax, dword [esi + 0x24]
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [esi + 8]
push eax
call edi
test eax, eax
je 0x542221
cmp byte [esi + 0x60], bl
push ebx
je 0x54220f
lea ecx, [esp + 0x10]
call fcn.00530ce0
mov ecx, dword [esp + 0xc]
mov edx, dword [0x5fe214]
mov eax, dword [esi + 8]
push ebx
push ecx
push edx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0xc]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ecx
call fcn.00531690
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.00530d00
jmp 0x542221
mov edx, dword [0x5fe214]
mov eax, dword [esi + 8]
push ebx
push edx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x38]
cmp eax, ebx
mov dword [esi + 0xc], ebx
je 0x542235
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0x38], ebx
mov dword [esi + 8], ebx
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x558786
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x5cf820
call fcn.00558988
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x5587c6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5587c6
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x5587de
cmp eax, 0x20b
je 0x5587cb
mov dword [ebp - 0x1c], ebx
jmp 0x5587f2
cmp dword [ecx + 0x84], 0xe
jbe 0x5587c6
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x5587ec
cmp dword [ecx + 0x74], 0xe
jbe 0x5587c6
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x5fe324], 0xffffffff
or dword [0x5fe328], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x5fe2d4]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x5fe2d0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x5fe320], eax
call fcn.00558c32
call fcn.00558cdb
cmp dword [0x5f3f00], ebx
jne 0x558852
push 0x558cd8
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00558cc0
push 0x5f20ec
push 0x5f20e8
call sub.MSVCR71.dll__initterm
push 0x558c76
call fcn.00558338
mov eax, dword [0x5fe2cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x5fe2c8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x5588a6
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x5f20e4
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x558924
cmp al, bl
je 0x5588d0
cmp dword [ebp - 0x20], ebx
jne 0x558924
mov al, byte [esi]
cmp al, bl
je 0x5588e0
cmp al, 0x20
ja 0x5588e0
inc esi
mov dword [ebp - 0x24], esi
jmp 0x5588d0
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x5588fc
movzx eax, word [ebp - 0x54]
jmp 0x5588ff
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.0057d71c
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x55891c
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x558979
cmp al, 0x22
jne 0x558933
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x558946
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x5588be
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.005589c3
ret
Function at 0x55c640
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebp
push ebx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ebx, ebx
mov byte [ecx + 5], bl
xor ebp, ebp
mov dword [ecx + 0x90], ebx
mov dword [ecx + 0x88], ebx
mov dword [ecx + 0x8c], ebx
mov dword [ecx + 0xf8], ebx
nop
lea esi, [esi]
xor bl, bl
mov byte [ebp + ecx + 0x94], bl
mov byte [ebp + ecx + 0x95], bl
mov byte [ebp + ecx + 0x96], bl
mov byte [ebp + ecx + 0x97], bl
mov byte [ebp + ecx + 0x98], bl
add ebp, 5
cmp ebp, 0x64
jb 0x55c670
movzx ebp, byte [edx + 1]
mov esi, ebp
sar esi, 4
and esi, 1
sar ebp, 3
and ebp, 1
movzx ebx, byte [edx + 2]
sar ebx, 2
and ebx, 3
movzx edi, byte [edx + 3]
sar edi, 6
and edi, 3
mov ebx, dword [ebx*4 + 0x5ffdb8]
test ebp, ebp
jne 0x55c6e9
cmp esi, 1
je 0x55c75b
test esi, esi
jne 0x55c6e9
mov ebp, ebx
sar ebp, 1
shr ebp, 0x1e
add ebp, ebx
mov ebx, ebp
sar ebx, 2
cmp ebx, 0x7d00
jl 0x55c6fd
cmp edi, 3
je 0x55c76e
mov ebp, 0x24
jmp 0x55c713
cmp ebx, 0x3e80
jl 0x55c752
cmp edi, 3
je 0x55c87b
mov ebp, 0x15
lea ebx, [ebp + 0x78]
cmp eax, ebx
jb 0x55c752
lea edx, [edx + ebp]
cmp byte [edx], 0x58
je 0x55c72b
xor eax, eax
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov al, byte [edx + 1]
cmp al, 0x69
je 0x55c73b
xor eax, eax
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov al, byte [edx + 2]
cmp al, 0x6e
je 0x55c74b
xor eax, eax
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov al, byte [edx + 3]
cmp al, 0x67
je 0x55c775
xor eax, eax
pop ebx
pop ebp
pop esi
pop edi
ret 8
add ebx, 0x80000000
adc ebx, 0x80000000
sar ebx, 1
jmp 0x55c6e9
mov ebp, 0x15
jmp 0x55c713
mov byte [ecx + 5], 1
movzx eax, byte [edx + 4]
shl eax, 0x18
movzx ebx, byte [edx + 5]
shl ebx, 0x10
or eax, ebx
movzx ebp, byte [edx + 6]
shl ebp, 8
or eax, ebp
movzx esi, byte [edx + 7]
or eax, esi
lea ebx, [edx + 8]
mov dword [ecx + 0x88], eax
test al, 1
je 0x55c7cd
movzx edi, byte [edx + 8]
shl edi, 0x18
movzx ebx, byte [edx + 9]
shl ebx, 0x10
or edi, ebx
movzx ebp, byte [edx + 0xa]
shl ebp, 8
or edi, ebp
movzx esi, byte [edx + 0xb]
or edi, esi
lea ebx, [edx + 0xc]
mov dword [ecx + 0x8c], edi
test al, 2
je 0x55c7f8
movzx edi, byte [ebx]
shl edi, 0x18
movzx edx, byte [ebx + 1]
shl edx, 0x10
or edi, edx
movzx ebp, byte [ebx + 2]
shl ebp, 8
or edi, ebp
movzx esi, byte [ebx + 3]
or edi, esi
add ebx, 4
mov dword [ecx + 0x90], edi
test al, 4
je 0x55c847
xor eax, eax
mov esi, esi
mov dl, byte [ebx + eax]
mov byte [eax + ecx + 0x94], dl
mov dl, byte [ebx + eax + 1]
mov byte [eax + ecx + 0x95], dl
mov dl, byte [ebx + eax + 2]
mov byte [eax + ecx + 0x96], dl
mov dl, byte [ebx + eax + 3]
mov byte [eax + ecx + 0x97], dl
mov dl, byte [ebx + eax + 4]
mov byte [eax + ecx + 0x98], dl
add eax, 5
cmp eax, 0x64
jb 0x55c800
add ebx, 0x64
mov eax, dword [ecx + 0x88]
test al, 8
je 0x55c86f
movzx ebp, byte [ebx]
shl ebp, 0x18
movzx eax, byte [ebx + 1]
shl eax, 0x10
or ebp, eax
movzx edx, byte [ebx + 2]
shl edx, 8
or ebp, edx
movzx ebx, byte [ebx + 3]
or ebp, ebx
mov dword [ecx + 0xf8], ebp
mov eax, 1
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov ebp, 0xd
jmp 0x55c713
Function at 0x5693ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0xb98f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xbad9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xb99002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00b9cdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xb99002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00b946e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00b9d20b
push 0x10
call fcn.00b9d1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xb98fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00b891c0
jmp 0xb98fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00b98b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xb98ff0
mov ecx, edi
call fcn.00b892c0
push edi
call fcn.00b9d1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xb99021
inc ebx
cmp ebx, 0x20
jb 0xb98f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xb9c1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b9c140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b9c140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b9c140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b9c140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb9cbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb9cc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xbae87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb9cc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb9cc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x52c56f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
fstp dword [edi]
inc ebp
stosb byte es:[edi], al
rcr dword [edx], 1
add byte [0x731d8d4b], ah
mov ch, 0x8c
mov ecx, 0x22bbf769
add al, 0x52
push edx
push edx
lea esp, [esp + 0x30]
jne 0x60b654
not ah
sete ah
jl 0x553171
lea eax, [esp - 0x6ff86741]
mov byte [edi - 1], 0
push edi
cwde
pushfd
mov dword [esp + 4], ebx
call fcn.00553bd6
sbb al, 0x3a
pop ecx
outsd dx, dword [esi]
mov dh, 0x87
jecxz 0x52c55b
pop edx
sbb edi, dword [esi - 0x75181a9f]
invalid
movzx ax, cl
setge ah
pushfd
pop eax
mov byte [edi - 1], 0
movzx ax, cl
push 0x5b2d216e
call fcn.00552d02
call fcn.006063f5
adc esi, ebp
ret 0xb19b

Function at 0x60bb22
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop esi
aaa
sub al, 0xb9
fld qword [ebx - 0x39]
lea esp, [esp + 4]
je 0x603c6f
call fcn.0060b719
lea esp, [esp + 0x2c]
jae 0x52bf56
dec cx
pushfd
mov ebx, eax
sal di, 3
mov cx, word [esp]
mov edi, eax
bswap ecx
leave
push eax
mov ecx, 0x104
stc
cmc
cmc
sub al, al
clc
test al, ch
call fcn.00604a10
sal byte [eax - 0x787bee80], cl
mov eax, 0xe8c69e8
xor byte [ebx], dh
push ss
fdivr st(4)
pop edi
add al, byte [edi + eax]
imul ebp, esp, 0x35
jno 0x60bb0c
jl 0x60bbd6
pop ebx
pop esi
arpl word [esi - 0x206215ec], sp
add esp, dword [ebp + 0x44]
jge 0x60bb44
lds edi, [edx + ebp*8 - 0x57]
in al, 0x54
add eax, 0x8a0ad6a1
lds esp, [ebx]
jbe 0x60bb3d
sbb al, 0xb8
mov dword [0xdeacc9e4], eax
cmp eax, 0xfebf8202
cmp al, 0x9e
int3
inc eax
invalid

Function at 0x60ec63
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x60e4d9
dec dword [ebp]
jmp 0x60e85b
pushfd
sub ebp, 4
pushfd
mov byte [esp], 0xe5
call fcn.0060ec98
stc
shr ecx, 0x19
pushal
bt cx, bx
mov word [esp + 8], bx
pushfd
or eax, ecx
jmp 0x60dfe9
inc edx
jmp 0x60f429
bt cx, si
xor al, byte [edx]
pushal
mov byte [esp + 4], 0x5a
call fcn.0060da8c
cmp dl, 0x37
bts cx, si
pushfd
movzx cx, bl
mov ecx, eax
mov byte [esp], 0x3e
push dword [esp]
bt ecx, 0x13
cmc
shl eax, 7
lea esp, [esp + 8]
jle 0x60da08
cmp dh, 0x13
clc
cmp si, 0x3d31
shr ecx, 0x19
jmp 0x60e39f
pushfd
cmc
or eax, ecx
cmp ah, 0x4f
cmp sp, 0xbd8a
xor al, byte [edx]
call 0x60ec63
jle 0x60e9b2
rol dh, cl
ror al, 4
push esp
mov byte [esp], cl
pushfd
inc al
rcr dh, 3
sar dx, 4
sub dh, 0x4d
neg al
rol dh, cl
btc edx, edx
shrd dx, bx, 8
and al, 0x3c
bswap edx
lea edx, [edx + 0x1a84887e]
rcr dh, 6
clc
mov edx, dword [eax + edi]
stc
pushfd
clc
stc
sub ebp, 4
push 0x33515035
call fcn.0060edbc
pushfd
push 0x50f3ebbc
pushal
mov dword [ebp], eax
mov byte [esp + 8], 0x57
pushfd
mov byte [esp + 4], 0x10
mov word [esp], 0xe46
lea esp, [esp + 0x2c]
jmp 0x60e301
pushfd
pushal
pushfd
lea esp, [esp + 0x30]
jne 0x60e1ec
jmp 0x60e95a
pushfd
push esi
lea esp, [esp + 8]
jnp 0x60d64a
mov dword [ebp], eax
push ebp
mov word [esp], ax
lea esp, [esp + 4]
jmp 0x60e301
pushfd
not dx
ror al, 4
push dword [esp]
pushal
not dl
inc al
bsf dx, bp
neg al
add dx, si
movsx edx, bl
dec dh
pushfd
and al, 0x3c
neg dx
xor dh, bh
inc dx
shrd dx, ax, cl
mov edx, dword [eax + edi]
cmp dx, bp
cmp esp, 0xff4548b6
jmp 0x60d986
mov byte [esp], 0xeb
jmp 0x60ec5e
call fcn.0060e9ff
jmp 0x60dd0e
jmp 0x60d7d3
Function at 0x4e8a36
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4e8a6e
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4e8a5c
mov al, 1
jmp 0x4e8ab8
cmp dword [ebx + 0x54], ecx
jne 0x4e8a65
mov al, 2
jmp 0x4e8ab8
cmp dword [ebx + 0x7c], ecx
jne 0x4e8ab8
mov al, 3
jmp 0x4e8ab8
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4e8a83
mov al, 4
jmp 0x4e8ab8
cmp ecx, 5
jne 0x4e8aa3
cmp ebx, 0
jne 0x4e8a91
mov al, 5
jmp 0x4e8ab8
cmp ebx, 1
jne 0x4e8a9a
mov al, 6
jmp 0x4e8ab8
cmp ebx, 2
jne 0x4e8aa3
mov al, 7
jmp 0x4e8ab8
cmp ecx, 6
jne 0x4e8aaf
cmp ebx, 0
jne 0x4e8ab1
mov al, 8
jmp 0x4e8ab8
cmp ebx, 1
jne 0x4e8ab8
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55d1ba
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x680598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00671d85
xor ebp, ebp
mov dword [esi], 0xb9e3fc
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
lea edi, [esi + 0x44]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x18]
mov dword [edi], fcn.00583660
call fcn.00549010
lea ecx, [edi + 0x30]
mov byte [esp + 0x38], 1
call fcn.0066f3cf
lea ebx, [edi + 0x44]
mov ecx, ebx
call fcn.00549010
mov dword [ebx], 0xb9bdc4
mov dword [edi], 0xb9e320
mov dword [esi + 0xa0], ebp
mov dword [esi + 0x9c], 0xbbce24
lea ecx, [esi + 0xb0]
call fcn.00549010
lea edi, [esi + 0xc8]
mov dword [edi + 4], ebp
mov dword [edi], 0xbbbd94
mov byte [esp + 0x38], 5
mov dword [esi], 0xb9e328
mov dword [esi + 0xac], ebp
call fcn.0067b745
mov eax, dword [eax + 0xc]
push 0x40e
push eax
call dword [0x68a5b0]
push eax
mov ecx, edi
call fcn.006779fa
mov ecx, dword [esi + 0xcc]
lea eax, [esp + 0x18]
push eax
push 0x18
push ecx
call dword [0x68a0f8]
mov ecx, dword [esp + 0x1c]
mov eax, 0x55555556
imul ecx
mov ecx, dword [esp + 0x20]
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0xd4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xd0], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x55d370
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x680625
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0xb9e328
mov dword [esp + 0x18], 0
lea ecx, [esi + 0xc8]
mov dword [esp + 0xc], ecx
mov dword [ecx], 0xbbae98
mov byte [esp + 0x18], 4
call fcn.00677a51
lea ecx, [esi + 0xb0]
mov byte [esp + 0x18], 2
mov dword [ecx], 0xb9bdc0
call fcn.00549210
lea ecx, [esi + 0x9c]
mov dword [esp + 0xc], ecx
mov dword [ecx], 0xbbae98
mov byte [esp + 0x18], 5
call fcn.00677a51
lea edi, [esi + 0x44]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 7
mov dword [ecx], 0xb9bdc0
call fcn.00549210
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 6
call fcn.0066f402
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 0
mov dword [ecx], 0xb9bdc0
call fcn.00549210
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.006795a0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret