joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513dc0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x599ca6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x138]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00577f79
mov ebp, dword [esp + 0x140]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.00577f79
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
test ecx, edx
je 0x513efa
mov cl, byte [0x5d6bfa]
mov dx, word [0x5d6bf8]
mov byte [esp + 0x12], cl
mov cl, dl
mov word [esp + 0x10], dx
add cl, al
lea edx, [esp + 0x10]
mov byte [esp + 0x10], cl
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x17], bl
call fcn.00579c8c
mov eax, dword [esi + 8]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x13c], ebx
call fcn.005781bb
mov edx, dword [0x5d8b34]
mov dword [esp + 0x14], edx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push 0x104
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x140], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea edx, [esp + 0x28]
lea ecx, [esp + 0x14]
push edx
mov byte [esp + 0x12f], bl
call fcn.00579da7
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.005781bb
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], bl
call fcn.00579c1e
lea ecx, [esp + 0x1c]
mov dword [esp + 0x134], 0xffffffff
call fcn.00579c1e
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
jb 0x513e1b
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret
Function at 0x513f30
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x599cc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x138]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00432380
mov ebp, dword [esp + 0x140]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.00432380
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
test ecx, edx
je 0x51406a
mov cl, byte [0x5d6bfa]
mov dx, word [0x5d6bf8]
mov byte [esp + 0x12], cl
mov cl, dl
mov word [esp + 0x10], dx
add cl, al
lea edx, [esp + 0x10]
mov byte [esp + 0x10], cl
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x17], bl
call fcn.00426f50
mov eax, dword [esi + 4]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x13c], ebx
call fcn.00432a00
mov edx, dword [0x59f140]
mov dword [esp + 0x14], edx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push 0x104
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x140], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea edx, [esp + 0x28]
lea ecx, [esp + 0x14]
push edx
mov byte [esp + 0x12f], bl
call fcn.00427bc0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.00432a00
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], bl
call fcn.00427900
lea ecx, [esp + 0x1c]
mov dword [esp + 0x134], 0xffffffff
call fcn.00427900
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
jb 0x513f8b
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret
Function at 0x5140a0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x599ce6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00434050
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.00434050
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x5141d9
mov edx, dword [0x5d7a8c]
mov cx, word [0x5d7a90]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.0042ca00
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.004346e0
mov edx, dword [0x59f144]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.0042d550
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.004346e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.0042d270
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.0042d270
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x5140fb
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x51a460
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x5f4608]
sub esp, 0x184
push ebp
push esi
xor esi, esi
cmp eax, esi
jne 0x51a47e
pop esi
xor eax, eax
pop ebp
add esp, 0x184
ret
push 6
push esi
push esi
push esi
call dword [0x5f45ec]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x51a49f
pop esi
xor eax, eax
pop ebp
add esp, 0x184
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [esp + 0x19c]
mov ecx, 0x13
lea edi, [esp + 0x44]
mov dword [esp + 0x40], esi
mov dword [ebx + 0xc], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, 6
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0x1c
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
xor edi, edi
push eax
push edi
push ebp
call dword [0x5f45f0]
test eax, eax
je 0x51a53f
mov ebx, dword [esp + 0x198]
lea ebp, [esp + 0x40]
mov ecx, dword [esp + 0x19c]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x51a51e
cmp esi, 0x14
jae 0x51a51e
mov ecx, dword [esp + 0x38]
inc esi
mov dword [ebp], ecx
add ebp, 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
inc edi
push edx
push edi
push eax
call dword [0x5f45f0]
test eax, eax
jne 0x51a4f3
mov ebx, dword [esp + 0x19c]
mov ebp, dword [esp + 0x10]
cmp dword [ebx], 0
je 0x51a66f
mov eax, dword [ebx + 4]
test eax, eax
je 0x51a66f
mov ecx, dword [eax]
mov eax, dword [ebx + 8]
cmp ecx, eax
jb 0x51a66f
test esi, esi
jbe 0x51a66f
lea edx, [esp + 0x40]
xor ebp, ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx]
mov dword [esp + 0x14], 0
mov esi, dword [eax]
mov eax, dword [ecx + ebp + 4]
cmp eax, 1
je 0x51a598
cmp eax, 2
jne 0x51a64b
test esi, esi
je 0x51a64b
push 0
lea edx, [esp + 0x18]
push esi
push edx
call dword [0x5f45fc]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x51a64b
test esi, esi
je 0x51a64b
push esi
call fcn.005196e0
add esp, 4
test eax, eax
je 0x51a598
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x91]
mov byte [esp + 0x90], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x90]
stosb byte es:[edi], al
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x104
push eax
push ecx
push 2
push edx
call fcn.00519310
add esp, 0x10
test eax, eax
je 0x51a64b
lea edi, [esp + 0x90]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xef
jbe 0x51a630
mov ecx, 0xef
push ecx
mov ecx, dword [ebx]
lea eax, [esp + 0x94]
lea edx, [ecx + ebp + 0x1c4]
push eax
push edx
call fcn.0052c232
add esp, 0xc
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add edx, 4
add ebp, 0x2b4
dec eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jne 0x51a576
mov ebp, dword [esp + 0x10]
push ebp
call dword [0x5f45f4]
mov ecx, dword [ebx + 8]
xor eax, eax
pop edi
pop ebx
test ecx, ecx
pop esi
pop ebp
setne al
add esp, 0x184
ret
Function at 0x51b380
Capabilities:
Get disk information

Disassembly:
mov eax, 0x2fd8
call fcn.00413cb0
mov eax, dword [ecx + 0x14]
push ebp
cmp eax, 2
mov dword [esp + 8], ecx
jne 0x51b3b4
cmp dword [ecx + 8], 4
jne 0x51b3b4
mov eax, dword [esp + 0x2fe0]
push eax
call fcn.0051b470
pop ebp
add esp, 0x2fd8
ret 4
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
test ebp, ebp
jne 0x51b3ca
pop ebp
add esp, 0x2fd8
ret 4
mov ecx, dword [0x5d66d0]
push ebx
push esi
push edi
mov dword [esp + 0x10], ecx
mov edi, 1
xor ebx, ebx
mov esi, edi
shl edi, 1
test ebp, esi
je 0x51b40d
mov dl, bl
lea eax, [esp + 0x10]
add dl, 0x41
push eax
mov byte [esp + 0x14], dl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x51b40d
cmp eax, 3
je 0x51b40d
cmp eax, 5
je 0x51b40d
not esi
and ebp, esi
inc ebx
cmp ebx, 0x1a
jl 0x51b3de
mov ecx, 0xbf3
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x2fec]
lea ecx, [esp + 0x18]
push ecx
push edi
push ebp
xor esi, esi
call fcn.00518500
add esp, 0xc
test eax, eax
je 0x51b455
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push edi
call fcn.0051bba0
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x2fd8
ret 4
Function at 0x520d60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x520da1
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x520da3
mov esi, edi
test esi, esi
je 0x520e18
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x520e0d
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x520e0d
cmp dword [esp + 0x1c], eax
jbe 0x520dde
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x520e0d
cmp esi, edi
je 0x520dff
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x520e18
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x520f70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x520fcf
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x520fcf
cmp dword [esp + 0xc], 3
jne 0x520fcf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x520fcf
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x520fcf
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x521130
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x59a68f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x5d8b34]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x52119b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x52119d
mov esi, edi
test esi, esi
je 0x521267
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x52125c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x5211df
cmp eax, 2
je 0x5211df
cmp eax, 6
je 0x5211df
cmp eax, 7
jne 0x52125c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.0057985d
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x521242
lea ecx, [esp + 0x14]
call fcn.00579da7
cmp esi, dword [esp + 0x14]
je 0x521237
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00579886
add esp, 4
jmp 0x521279
call fcn.00579886
add esp, 4
lea ecx, [esp + 0x10]
push 0x5efa58
call fcn.00579da7
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x521267
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x521279
push eax
lea ecx, [esp + 0x14]
call fcn.00579da7
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00579993
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00579c1e
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x5213c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x5213f7
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x5213fa
mov esi, dword [ebp + 8]
test esi, esi
je 0x5215ab
call fcn.0048b040
test eax, eax
je 0x5214e4
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x52141b
mov dword [ebp + 0x10], eax
jmp 0x52144e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.00413cb0
mov ecx, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp + 0x10], ebx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x52159f
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x521488
cmp eax, 2
je 0x521488
cmp eax, 6
je 0x521488
cmp eax, 7
jne 0x52159f
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.0057985d
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x52158a
mov ecx, dword [ebp + 0x18]
call fcn.0042d550
cmp esi, dword [ebp + 8]
je 0x521574
jmp 0x52156d
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x52159f
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x52151e
cmp eax, 2
je 0x52151e
cmp eax, 6
je 0x52151e
cmp eax, 7
jne 0x52159f
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.0057985d
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x52158a
mov ecx, dword [ebp + 0x18]
call fcn.0042d620
cmp esi, dword [ebp + 8]
je 0x521574
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.00579886
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00579886
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x5efa58
call fcn.0042d620
cmp esi, dword [ebp + 8]
je 0x5215ab
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x521fd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59a758
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x522026
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x522029
mov esi, dword [ebp + 8]
test esi, esi
je 0x52210f
call fcn.0048b040
test eax, eax
je 0x5220aa
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x522045
xor ebx, ebx
jmp 0x522075
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.00413cb0
mov eax, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [ebp + 0x18]
push edi
call fcn.00414e6e
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x522103
cmp esi, dword [ebp + 8]
je 0x5220a3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x522111
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x18]
push edx
call fcn.004270f0
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [ebp + 0x10]
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x5220f4
cmp esi, dword [ebp + 8]
je 0x5220de
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00427900
mov eax, 1
jmp 0x522111
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00427900
cmp esi, dword [ebp + 8]
je 0x52210f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x522dc0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x522f38
mov eax, dword [esp + 0x10]
test eax, eax
je 0x522f17
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x522e16
mov eax, 0x104
mov dword [esp + 0x1c], eax
inc eax
push eax
call fcn.0057985d
mov esi, eax
add esp, 4
test esi, esi
je 0x522f38
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x522f2f
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x522f2f
mov edi, dword [esp + 0x20]
test edi, edi
je 0x522f2f
push ebp
push edi
call fcn.00522dc0
add esp, 8
test eax, eax
je 0x522f24
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x5f5090]
test eax, eax
je 0x522ec1
test ebp, ebp
je 0x522ec1
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x522f2f
jmp 0x522ecd
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x522f2f
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x522f0e
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x522f2f
mov eax, dword [esp + 0x14]
jmp 0x522e6a
push esi
call fcn.00579886
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x522f2f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00579886
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x523a90
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
push ebp
lea edi, [esi + 0xec]
mov ecx, edi
call fcn.005297f0
test al, al
jne 0x523ab1
pop edi
pop esi
pop ebp
ret 4
lea ecx, [esi + 0x78]
call fcn.00527c60
cmp eax, 1
jne 0x523ac6
pop edi
pop esi
xor al, al
pop ebp
ret 4
mov al, byte [esi + 0xe8]
test al, al
je 0x523ad8
pop edi
pop esi
xor al, al
pop ebp
ret 4
lea ecx, [esi + 0x20]
call fcn.00528d10
push ebp
mov ecx, edi
call fcn.00529810
mov ecx, dword [esi + 0x114]
call fcn.00527780
test al, al
je 0x523b8f
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x523b0a
pop edi
pop esi
xor al, al
pop ebp
ret 4
mov dword [esi + 0x14], 0x12345678
mov dword [esi + 0x18], 0x23456789
mov dword [esi + 0x1c], 0x34567890
mov eax, dword [esi + 0x10]
xor edi, edi
test eax, eax
jbe 0x523b7b
mov eax, dword [esi + 0xc]
mov cl, byte [edi + eax]
mov eax, dword [esi + 0x14]
mov byte [esp + 0x10], cl
mov ecx, esi
mov edx, dword [esp + 0x10]
push edx
push eax
call fcn.005266a0
mov edx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, edx
mov edx, dword [esi + 0x1c]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.005266a0
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
inc edi
cmp edi, eax
jb 0x523b28
mov ecx, esi
call fcn.00526420
test al, al
jne 0x523b8f
push 0xffffffffffffff94
mov ecx, esi
call fcn.00523730
mov eax, dword [esi + 0x114]
mov di, word [eax + 0xe]
test di, di
je 0x523bad
cmp di, 8
je 0x523bb3
push 0xffffffffffffff9b
mov ecx, esi
call fcn.00523730
cmp di, 8
jne 0x523bea
mov al, byte [esi + 4]
test al, al
je 0x523bc2
lea eax, [esi + 0xcc]
jmp 0x523bc4
xor eax, eax
push 0x38
push str.1.1.4
lea ecx, [esi + 0x28]
push 0xfffffffffffffff1
push ecx
mov dword [esi + 0x50], eax
call fcn.0050e0c0
test eax, eax
je 0x523bea
cmp eax, 2
je 0x523bea
push eax
mov ecx, esi
call fcn.00523730
mov ecx, dword [esi + 0x114]
mov edx, dword [ecx + 0x18]
mov dword [esi + 0x64], edx
call fcn.00527780
test al, al
je 0x523c03
add dword [esi + 0x64], 0xfffffff4
mov eax, dword [esi + 0x114]
pop edi
mov ecx, dword [eax + 0x1c]
mov dword [esi + 0x68], 0
mov dword [esi + 0x60], ecx
mov dword [esi + 0x3c], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0xe8], 0xff
pop esi
mov al, 1
pop ebp
ret 4