joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d12d
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x50d179
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp eax, 0x420
jne 0x50d184
push str.OService::StartService___Service_instance_already_running
push 0x64
mov edx, 0x7c1
mov ecx, 0x2541043
call fcn.004f4c26
pop ecx
pop ecx
cmp byte [ebx + 0x14], 0
je 0x50d1c5
mov esi, dword [ebx + 0xc]
jmp 0x50d1a3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
call fcn.0050d909
xor al, al
jmp 0x50d1c7
add esi, 0xffffffe4
mov ecx, esi
call fcn.0050d12d
mov edi, dword [ebx + 8]
cmp esi, edi
jne 0x50d199
mov esi, dword [ebx + 0xc]
cmp edi, esi
je 0x50d1c2
mov ecx, edi
call fcn.0050cfd9
add edi, 0x1c
cmp edi, esi
jne 0x50d1b1
mov edi, dword [ebx + 8]
mov dword [ebx + 0xc], edi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50d1ce
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x816078]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0xc]
push esi
push edi
push eax
mov esi, ecx
call fcn.0050d0c3
mov eax, dword [esp + 0x18]
mov byte [ebx], 0
cmp eax, 1
je 0x50d2ec
cmp byte [esi + 0x14], 0
mov edi, dword [esp + 0x2c]
je 0x50d21c
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0050d303
mov eax, dword [esp + 0x18]
mov byte [ebx], 1
cmp eax, 3
je 0x50d275
lea eax, [esp + 0x38]
push eax
push 1
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x50d26d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp eax, 0x426
je 0x50d266
lea eax, [esp + 0x10]
mov ecx, 0x2541045
push eax
push str.OService::StopServiceRecursive___Failed_to_control_service_:_errCode___d
push 0x64
call fcn.0050207b
xor al, al
jmp 0x50d2ef
mov al, 1
jmp 0x50d2ef
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x50d2ec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x7fffffff
jb 0x50d2c4
cmp edi, 0x2710
jbe 0x50d29d
push 0xa
mov eax, edi
xor edx, edx
pop ecx
div ecx
jmp 0x50d2a2
mov eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0050d0c3
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
cmp eax, 1
jne 0x50d27a
jmp 0x50d2c8
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x50d2ec
push str.OService::StopServiceRecursive___Timed_out_waiting_for_service_to_stop
push 0x64
mov edx, 0x7c1
mov ecx, 0x2541046
call fcn.004f4c26
mov eax, dword [esp + 0x20]
cmp eax, 1
pop ecx
pop ecx
sete al
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
Function at 0x50d303
Capabilities:
Enumerate services

Disassembly:
push 0x68
mov eax, 0x6a4a87
call fcn.0064d086
mov edi, ecx
mov dword [ebp - 0x40], edi
xor ebx, ebx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
push str.OService::TryStopDependents___Enumerating_dependent_services
push 0x64
mov edx, 0x7c1
mov dword [ebp - 4], ebx
mov ecx, 0x2541047
call fcn.004f4c26
pop ecx
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push 1
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x50d383
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov dword [ebp - 0x34], eax
cmp eax, 0xea
je 0x50d393
mov ecx, 0x2541048
lea eax, [ebp - 0x34]
push eax
push str.OService::TryStopDependents___Warning:_failed_to_enumerate_dependent_services_:_errCode___d
push 0x64
call fcn.0050207b
lea ecx, [ebp - 0x50]
call fcn.00419dd5
call fcn.0064cfd3
ret 4
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x38]
mov ecx, eax
call fcn.00433e9e
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x34], eax
push ecx
push dword [ebp - 0x38]
push eax
push 1
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x50d3ce
call esi
mov dword [ebp - 0x34], eax
mov ecx, 0x2541049
jmp 0x50d373
mov edi, ebx
mov dword [ebp - 0x44], ebx
cmp edi, dword [ebp - 0x3c]
jae 0x50d383
push ecx
push ecx
lea ecx, [ebp - 0x74]
mov byte [ebp - 0x2d], bl
call fcn.0050ce5f
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, 0x7fffffff
jae 0x50d41b
lea eax, [ebp - 0x3c]
mov ecx, 0x254104a
push eax
push str.OService::TryStopDependents___Warning:_timed_out_before_stopping_all_dependent_services
push 0x64
call fcn.0050207b
lea ecx, [ebp - 0x74]
call fcn.0050cfd9
jmp 0x50d383
imul esi, edi, 0x24
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
add esi, ecx
push esi
push ecx
push ecx
call fcn.0050da14
push dword [esi]
lea ecx, [ebp - 0x2c]
call fcn.0040d412
push 0x3c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x74]
call fcn.0050d066
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.0040d475
lea ecx, [ebp - 0x74]
test bl, bl
jne 0x50d464
call fcn.0050cfd9
xor ebx, ebx
mov byte [ebp - 4], bl
jmp 0x50d4cc
push dword [ebp + 8]
lea eax, [ebp - 0x2d]
push eax
call fcn.0050d1ce
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x40]
jmp 0x50d4ae
xor ebx, ebx
cmp byte [ebp - 0x2d], bl
je 0x50d4c1
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [eax + 8]
call fcn.0050d685
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], bl
call fcn.0050cfd9
inc edi
mov dword [ebp - 0x44], edi
jmp 0x50d3d3
Function at 0x50d4d5
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x10]
push ebx
push esi
cmp dword [eax + 0x10], 0
mov ebx, ecx
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
jne 0x50d503
xor eax, eax
jmp 0x50d50b
cmp dword [eax + 0x14], 8
jb 0x50d50b
mov eax, dword [eax]
cmp dword [edx + 0x14], 8
jb 0x50d513
mov edx, dword [edx]
cmp dword [esi + 0x14], 8
jb 0x50d51b
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x50d525
mov ecx, dword [edi]
push 0
push 0
push 0
push 0
push eax
push edx
push 1
push 2
push 0x10
push 0x20000000
push esi
push ecx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebx + 4], eax
test eax, eax
je 0x50d55e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov dword [ebp - 0x394], eax
mov edx, 0x7c1
lea eax, [ebp - 0x394]
push eax
push str.OService::Install___CreateService_failed__d
push ecx
mov ecx, 0x254104e
call fcn.0050a701
push edi
push str.failed_to_create_service__s
call esi
push eax
push ecx
lea ecx, [ebp - 0x390]
call fcn.0050a643
push 0x811494
lea eax, [ebp - 0x390]
push eax
call fcn.0064f293
int3

Function at 0x50d5af
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], 0x15180
inc eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push eax
push 2
push dword [ecx + 4]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb al, al
xor ecx, ebp
inc al
call fcn.0064c681
mov esp, ebp
pop ebp
ret 0x10
Function at 0x50e11e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0xc0], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
or edi, 0xffffffff
test esi, esi
je 0x50e270
push 1
push 1
push 1
lea edx, [ebp - 0xc0]
xor ecx, ecx
call fcn.0051d5ac
mov dword [ebp - 0xbc], eax
test eax, eax
js 0x50e175
mov ecx, dword [ebp - 0xc0]
call fcn.0050dfa8
mov edi, eax
and dword [ebp - 0xc4], 0
lea edx, [ebp - 0xc4]
push 1
push 1
push 1
mov ecx, 0x832228
call fcn.0051d5ac
xor ecx, ecx
test eax, eax
push 4
cmovns ecx, dword [ebp - 0xc4]
xor eax, eax
push esi
push ebx
push eax
mov dword [ebp - 0xc8], ecx
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x50e267
cmp edi, 0xffffffff
je 0x50e20b
push 0xaa
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0064f890
add esp, 0xc
lea eax, [ebp - 0xbc]
lea edx, [ebp - 0xb8]
mov ecx, edi
push eax
push 0
push 0x55
call fcn.0051db5c
cmp dword [ebp - 0xbc], 0
jl 0x50e20b
push 4
push esi
push ebx
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x50e267
mov edi, dword [ebp - 0xc8]
cmp edi, 0xffffffff
je 0x50e262
push 0xaa
lea eax, [ebp - 0xb8]
push 0
push eax
call fcn.0064f890
add esp, 0xc
lea eax, [ebp - 0xbc]
lea edx, [ebp - 0xb8]
mov ecx, edi
push eax
push 0
push 0x55
call fcn.0051db5c
cmp dword [ebp - 0xbc], 0
jl 0x50e262
push 4
push esi
push ebx
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x50e267
xor eax, eax
mov word [esi], ax
mov ecx, esi
call fcn.004319dc
jmp 0x50e272
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
Function at 0x50e3eb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc0
mov eax, 0x6a4bd1
call fcn.0064d018
xor ebx, ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xcc], 0x834ad8
mov dword [0x834ad8], ebx
mov dword [0x834adc], ebx
mov dword [0x834ae0], ebx
xor ecx, ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], ebx
push eax
inc ecx
push ecx
push ebx
push str.Control_PanelInternational
push SysReAllocString
mov dword [ebp - 0xc8], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x50e554
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0xc0]
push eax
push ebx
push ebx
push 0x20000020
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
mov dword [ebp - 0xc0], ebx
call edi
test eax, eax
jne 0x50e548
cmp dword [ebp - 0xc0], 3
jbe 0x50e548
push dword [ebp - 0xc0]
call fcn.006707e1
mov esi, eax
pop ecx
test esi, esi
je 0x50e548
lea eax, [ebp - 0xc0]
push eax
push esi
push ebx
push 0x20
push str.Languages
push str.User_Profile
push dword [ebp - 0xc4]
call edi
test eax, eax
jne 0x50e541
mov ebx, dword [ebp - 0xc0]
cmp ebx, 3
jbe 0x50e541
xor edx, edx
shr ebx, 1
push edx
pop ecx
mov eax, edx
mov edi, edx
mov word [esi + ebx*2 - 2], cx
je 0x50e541
jmp 0x50e4ec
cmp eax, ebx
jae 0x50e4f2
inc eax
cmp word [esi + eax*2], dx
je 0x50e4e7
cmp word [esi + edi*2], dx
jne 0x50e53c
cmp edi, eax
jbe 0x50e53c
xor ecx, ecx
lea eax, [esi + eax*2]
mov word [ebp - 0xbc], cx
lea ecx, [ebp - 0xbc]
push 0x55
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ResolveLocaleName]
test eax, eax
je 0x50e537
cmp word [ebp - 0xbc], 0
je 0x50e537
lea eax, [ebp - 0xbc]
mov ecx, 0x834ad8
push eax
call fcn.0050e561
lea eax, [edi + 1]
xor edx, edx
inc edi
cmp edi, ebx
jb 0x50e4ec
push esi
call fcn.0064e37d
pop ecx
push dword [ebp - 0xc4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x834ad8
call fcn.0064cfc2
ret 4
Function at 0x518cdb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x220
mov eax, dword [0x816078]
xor eax, esp
mov dword [esp + 0x21c], eax
cmp dword [0x8328c4], 0
push esi
push edi
jne 0x518e11
xor edi, edi
lea eax, [esp + 0x18]
push edi
push 0x104
push eax
mov eax, dword [0x81cbdc]
mov ecx, 0x81cbdc
push edi
push edi
push 0x19
call dword [eax + 4]
mov esi, 0x572
test eax, eax
jne 0x518d7f
push str.msi_based_gimme_DoOleoInit_FGimmeFileEx_failed
push 0x32
mov edx, esi
mov ecx, 0x23814a2
call fcn.004f4e45
pop ecx
pop ecx
lea eax, [esp + 8]
mov dword [esp + 8], 0x208
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push 2
push str.office.odf
push str.SoftwareMicrosoftOffice16.0CommonFilesPaths
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x518d7f
push str.msi_based_gimme_DoOleoInit_GetFallBackOleoOdfPath_failed
push 0x32
mov ecx, 0x23814a3
jmp 0x518e08
xor ecx, ecx
mov eax, 0x18000
cmp dword [0x816cd4], 0x16
cmove eax, ecx
lea ecx, [esp + 0x18]
push eax
call fcn.00518e3c
test eax, eax
jns 0x518de7
cmp eax, 0x8ff00004
je 0x518dee
mov dword [esp + 0x14], eax
mov edx, esi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x6dbf5c
push eax
push str.msi_based_gimme_DoOleoInit_MsoHrInitializeOleo_failed
push 0xa
mov ecx, 0x23814c0
mov dword [esp + 0x1c], str.HResult
call fcn.0041f40e
mov eax, dword [0x81cf10]
mov ecx, 0x81cf10
push 0x85e609
call dword [eax + 4]
xor al, al
jmp 0x518e13
cmp eax, 0x8ff00004
jne 0x518dfc
push 0x767940
push 0x32
mov ecx, 0x23814c1
jmp 0x518e08
push str.msi_based_gimme_DoOleoInit_MsoHrInitializeOleo_succeeded
push 0x64
mov ecx, 0x23814c2
mov edx, esi
call fcn.004f4e45
pop ecx
pop ecx
mov al, 1
mov ecx, dword [esp + 0x224]
pop edi
pop esi
xor ecx, esp
call fcn.0064c681
mov esp, ebp
pop ebp
ret

Function at 0x51a6a5
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x51a6b1
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x51a6d9
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x51a6bf
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret
Function at 0x550e89
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69e098
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
call fcn.006707e1
pop ecx
test eax, eax
je 0x550f5e
xor ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov dword [eax], 0x77a340
mov dword [eax + 8], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
call fcn.0044863f
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x550eff
and dword [ebp - 0x10], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [edi + 0x30]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1c]
call fcn.0047e9f0
call fcn.0063a513
mov ecx, eax
mov esi, edx
mov eax, dword [edi + 0x8c]
mov edx, 0x989680
imul edx
add ecx, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
adc esi, edx
lea ecx, [edi + 0x64]
push eax
mov dword [ebp - 0x10], esi
call fcn.005508c5
lea ecx, [ebp - 0x1c]
call fcn.0047e9a6
mov al, byte [edi + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004227c0
int3

Function at 0x5522b2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a965a
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x1c
call fcn.006707e1
mov edi, eax
pop ecx
test edi, edi
je 0x552365
lea eax, [edi + 4]
mov dword [edi], 0x779368
mov dword [eax + 4], eax
push eax
mov dword [eax + 8], eax
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor ebx, ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [esi], 0x77a690
mov dword [esi + 4], edi
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov byte [ebp - 4], 1
test ecx, ecx
je 0x55232a
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], bl
call fcn.0055278c
mov byte [esi + 0x14], 1
mov eax, esi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0xf
mov byte [esi + 0x18], bl
mov byte [esi + 0x30], bl
mov dword [esi], 0x77a690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004f732c
int3
Function at 0x591a85
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
mov eax, dword [0x816078]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
xor ebx, ebx
mov dword [esp + 0x1c], 0x67452301
push esi
xorps xmm0, xmm0
mov dword [esp + 0x24], 0xefcdab89
mov edx, ebx
movlpd qword [esp + 0x14], xmm0
push edi
mov edi, ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], 0x98badcfe
mov esi, ebx
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], 0xc3d2e1f0
mov al, byte [esi + 0x77a890]
mov byte [esp + edx + 0x38], al
mov edx, dword [esp + 0x20]
inc edx
mov dword [esp + 0x20], edx
cmp edx, 0x40
jne 0x591b04
lea ecx, [esp + 0x18]
call fcn.0059091b
mov edx, dword [esp + 0x20]
inc esi
cmp esi, 0x10
jne 0x591adf
movzx eax, word [edi]
test ax, ax
je 0x591bd1
mov edx, 0x3ff
mov esi, ebx
mov ecx, eax
mov dword [esp + 0x14], edx
lea eax, [ecx + 0x2800]
mov dword [esp + 0x10], 1
add edi, 2
cmp ax, dx
ja 0x591b5f
movzx edx, word [edi]
lea eax, [edx + 0x2400]
cmp ax, word [esp + 0x14]
ja 0x591b59
push 2
mov word [esp + esi*2 + 0x182], dx
add edi, 2
pop eax
jmp 0x591b62
mov eax, dword [esp + 0x10]
jmp 0x591b62
xor eax, eax
inc eax
mov word [esp + esi*2 + 0x17c], cx
add esi, eax
movzx eax, word [edi]
mov edx, eax
mov ecx, eax
mov dword [esp + 0x10], edx
test ax, ax
je 0x591b81
cmp esi, 0xf
jb 0x591bc0
push ebx
push ebx
push ebx
push esi
lea eax, [esp + 0x18c]
push eax
push esi
push eax
push 0xa00
push 0x6d92dc
call dword [sym.imp.KERNEL32.dll_LCMapStringEx]
lea eax, [esi + esi]
push eax
lea eax, [esp + 0x180]
push eax
lea ecx, [esp + 0x20]
call fcn.005908e2
cmp word [esp + 0x10], bx
je 0x591bcd
movzx eax, word [edi]
mov esi, ebx
movzx ecx, ax
mov edx, 0x3ff
jmp 0x591b23
mov edx, dword [esp + 0x20]
mov esi, edx
xor edi, edi
shl esi, 3
add esi, dword [esp + 0x18]
adc edi, dword [esp + 0x1c]
mov byte [esp + edx + 0x38], 0x80
jmp 0x591beb
mov byte [esp + eax + 0x38], bl
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x40
jne 0x591c06
lea ecx, [esp + 0x18]
call fcn.0059091b
mov eax, dword [esp + 0x20]
cmp eax, 0x38
jne 0x591be7
bswap esi
bswap edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], esi
call fcn.0059091b
mov eax, dword [esp + ebx*4 + 0x24]
bswap eax
mov dword [esp + ebx*4 + 0x24], eax
inc ebx
cmp ebx, 5
jne 0x591c20
mov al, byte [esp + 0x2b]
lea esi, [esp + 0x24]
and al, 0xf
mov ecx, dword [esp + 0x19c]
or al, 0x50
mov byte [esp + 0x2b], al
mov eax, dword [ebp + 8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 4
Function at 0x5b44f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0x20119
push 0
mov esi, ecx
push str.SoftwareMicrosoftClickToRunOverRide
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5b456f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], 4
cmp dword [eax + 0x14], 8
jb 0x5b453c
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b4566
cmp dword [ebp + 0xc], 4
jne 0x5b4566
cmp dword [ebp - 0xc], eax
setne al
mov dword [esi], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5b4b9b
Capabilities:
Write file on windows

Disassembly:
push 0x31c
mov eax, 0x6b21d6
call fcn.0064d018
mov ebx, ecx
mov dword [ebp - 0x328], ebx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x324]
and dword [ebp - 0x324], 0
push 0
push ecx
mov esi, dword [eax + 4]
sub esi, dword [eax]
push esi
push dword [eax]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5b4ce3
cmp dword [ebp - 0x324], esi
je 0x5b4cdb
push str.bytesWritten
lea ecx, [ebp - 0x88]
call fcn.0040d412
push str.bytesToWrite
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xa
call fcn.0040d412
push str.path
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xb
call fcn.0040d412
push str.Failed_to_write_the_correct_number_of_bytes_to_a_file
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0xc
call fcn.004139db
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe8]
mov edx, dword [ebp - 0x324]
call fcn.004454e4
mov ebx, eax
mov edx, esi
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x100]
call fcn.004454e4
mov edi, eax
push ecx
push ecx
push str.shared::io::File::Write
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x320]
call fcn.005def6c
mov esi, eax
push ebx
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x10
push eax
push edi
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x328]
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.005df153
mov ecx, eax
call fcn.005df1c4
mov ecx, eax
call fcn.005df1c4
mov ecx, eax
call fcn.005df1c4
push eax
lea ecx, [ebp - 0x210]
call fcn.005df20a
push 0x811b60
lea eax, [ebp - 0x210]
jmp 0x5b4d84
call fcn.0064cfc2
ret 4
push str.bytesToWrite
lea ecx, [ebp - 0x40]
call fcn.0040d412
push str.path
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 5
call fcn.0040d412
push str.Failed_to_write_to_a_file
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.004139db
mov edx, esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd0]
call fcn.004454e4
mov edi, eax
push ecx
push ecx
push str.shared::io::File::Write
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x298]
call fcn.005def6c
mov esi, eax
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 9
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.005df153
mov ecx, eax
call fcn.005df1c4
mov ecx, eax
call fcn.005df1c4
push eax
lea ecx, [ebp - 0x188]
call fcn.005df20a
push 0x811b60
lea eax, [ebp - 0x188]
push eax
call fcn.0064f293
int3
Function at 0x5b4e3d
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x144
mov eax, 0x6b2219
call fcn.0064d018
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5b4e58
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x5b4e70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 2
jne 0x5b4e76
call fcn.0064cfc2
ret
push str.path
lea ecx, [ebp - 0x40]
call fcn.0040d412
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push str.Failed_to_delete_a_file
call fcn.004139db
push ecx
push ecx
push str.shared::io::FileReference::Delete
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x150]
call fcn.005def6c
mov edx, eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00414a80
push eax
lea eax, [ebp - 0x40]
mov ecx, edx
push eax
push edi
call fcn.005df153
mov ecx, eax
call fcn.005df1c4
push eax
lea ecx, [ebp - 0xc8]
call fcn.005df20a
push 0x811b60
lea eax, [ebp - 0xc8]
push eax
call fcn.0064f293
int3