joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519d00
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5822a3
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x14c]
mov edi, dword [esp + 0x150]
xor ebx, ebx
push 0x5aba3c
mov ecx, esi
mov dword [esp + 0x148], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
call fcn.00414a70
mov ebp, 1
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [esp + 0x1c]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x30], ebp
call fcn.00414a70
mov dword [esp + 0x144], ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push ecx
push reloc.WSOCK32.dll_accept
mov byte [esp + 0x158], 2
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x519e5e
mov ebp, dword [esp + 0x14]
push 0x103
lea edx, [esp + 0x39]
push ebx
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
mov byte [esp + 0x40], bl
call fcn.004aeb90
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push edi
push ebp
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x519e53
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
call fcn.00414a70
push eax
mov ecx, esi
mov byte [esp + 0x148], 3
call fcn.00417aa0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x144], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x519e53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebp, ebx
je 0x519e5e
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x144], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x519e85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.004adaab
add esp, 0x134
ret
Function at 0x519eb0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5822a3
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x14c]
mov edi, dword [esp + 0x150]
xor ebx, ebx
push 0x5aba3c
mov ecx, esi
mov dword [esp + 0x148], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
call fcn.00414a70
mov ebp, 1
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [esp + 0x1c]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x30], ebp
call fcn.00414a70
mov dword [esp + 0x144], ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x158], 2
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x51a00e
mov ebp, dword [esp + 0x14]
push 0x103
lea edx, [esp + 0x39]
push ebx
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
mov byte [esp + 0x40], bl
call fcn.004aeb90
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push edi
push ebp
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x51a003
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
call fcn.00414a70
push eax
mov ecx, esi
mov byte [esp + 0x148], 3
call fcn.00417aa0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x144], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x51a003
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebp, ebx
je 0x51a00e
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x144], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x51a035
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.004adaab
add esp, 0x134
ret
Function at 0x51a330
Capabilities:
Create process on windows

Disassembly:
push ecx
lea eax, [esp]
push eax
call fcn.0051a130
add esp, 4
cmp dword [esp + 0xc], 0
je 0x51a359
mov eax, dword [esp]
cmp dword [eax - 0xc], 0
jle 0x51a359
mov ecx, dword [esp + 8]
push 5
push 0
push ecx
push eax
jmp 0x51a364
mov edx, dword [esp + 8]
push 5
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
mov eax, dword [esp]
setg cl
push esi
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov esi, ecx
mov ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x51a39d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
pop ecx
ret

Function at 0x51a3b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5823a1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.00414a70
mov edi, 1
push edi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], edi
call fcn.004238d0
mov eax, dword [eax]
push 0x5a34f4
push eax
mov dword [esp + 0x2c], edi
call fcn.004aeff5
add esp, 8
cmp eax, ebx
mov eax, dword [esp + 0x18]
setne byte [esp + 0x13]
add eax, 0xfffffff0
mov byte [esp + 0x24], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x51a449
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x13], bl
je 0x51a45c
push edi
push 0x5a34f4
mov ecx, esi
call fcn.00417770
mov edi, dword [esp + 0x34]
cmp edi, ebx
jne 0x51a468
xor eax, eax
jmp 0x51a479
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x51a470
sub eax, edx
push eax
push edi
mov ecx, esi
call fcn.00417770
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x51a4a0
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5823cb
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov esi, dword [esp + 0xc0]
mov edi, dword [esp + 0xc4]
mov ebx, dword [esp + 0xc8]
mov ebp, dword [esp + 0xcc]
push str.open
lea ecx, [esp + 0x18]
call fcn.00414a70
cmp dword [esp + 0xd4], 0
mov dword [esp + 0xb8], 0
je 0x51a544
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 5
jbe 0x51a544
push 5
push str.runas
lea ecx, [esp + 0x1c]
call fcn.00414fa0
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0x14]
push ecx
push ebp
push ebx
push edi
push edx
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0xb8], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x51a588
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004adaab
add esp, 0xa8
ret

Function at 0x51a7c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x582438
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0051a660
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.0051a6e0
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0xc], vtable.CCriticalSection.0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esp + 8]
call fcn.004a6c38
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
Function at 0x521100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x582e96
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], vtable.EProperty.0
lea edi, [esi + 8]
call fcn.0047cfdc
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x52114f
push 0x80004005
call fcn.00414da0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x1c], ebx
call fcn.0047cfdc
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x52117b
push 0x80004005
call fcn.00414da0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x40], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x24], ecx
push eax
mov ecx, edi
mov byte [esp + 0x20], 1
mov dword [esi + 0xc], edx
call fcn.00417aa0
mov cl, byte [esp + 0x30]
mov byte [esi + 5], bl
mov byte [esi + 4], cl
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov dword [esi + 0x10], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10

Function at 0x529720
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
push 2
lea eax, [esp + 0x10]
push 1
push eax
xor edi, edi
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
call fcn.004b3b30
add esp, 0x10
cmp eax, 2
jne 0x529837
mov al, byte [esp + 8]
cmp al, 0x42
jne 0x529791
cmp byte [esp + 9], 0x4d
jne 0x529837
cmp dword [esp + 0x20], 1
jne 0x529837
mov edi, 1
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004adaab
add esp, 0x10
ret
cmp al, 0xff
jne 0x5297d0
cmp byte [esp + 9], 0xd8
jne 0x529837
cmp dword [esp + 0x20], 2
jne 0x529837
push esi
call fcn.0056ba33
add esp, 4
cmp al, 0xff
jne 0x529837
mov edi, 2
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004adaab
add esp, 0x10
ret
cmp al, 0x89
jne 0x529837
cmp byte [esp + 9], 0x50
jne 0x529837
cmp dword [esp + 0x20], 3
jne 0x529837
push esi
push 6
xor eax, eax
lea ecx, [esp + 0x14]
push 1
push ecx
mov byte [esp + 0x1c], 0
mov dword [esp + 0x1d], eax
mov byte [esp + 0x21], al
call fcn.004b3b30
add esp, 0x10
cmp eax, 6
jne 0x529837
cmp byte [esp + 0xc], 0x4e
jne 0x529837
cmp byte [esp + 0xd], 0x47
jne 0x529837
cmp byte [esp + 0xe], 0xd
jne 0x529837
mov al, 0xa
cmp byte [esp + 0xf], al
jne 0x529837
cmp byte [esp + 0x10], 0x1a
jne 0x529837
cmp byte [esp + 0x11], al
jne 0x529837
mov edi, 4
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004adaab
add esp, 0x10
ret
Function at 0x531b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584a53
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5eabd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0052fbd0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CAudioMP3Reader.0
push 0
push 0x5b6300
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.00496d11
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x18], 0
push 0x20000
call fcn.00473c84
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x1c], ecx
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x30], 0
mov ecx, dword [ebp - 0x14]
call fcn.00531d30
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x53f0b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [0x6e92a8], 0
je 0x53f0ca
mov eax, 1
jmp 0x53f20c
push 0x5b79c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x6e92a8], eax
cmp dword [0x6e92a8], 0
jne 0x53f0f9
push str.Cannot_load_lame_enc.dll
push 1
mov ecx, dword [ebp - 4]
call fcn.00534510
xor eax, eax
jmp 0x53f20c
push str.beInitStream
mov eax, dword [0x6e92a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e92ac], eax
push str.beEncodeChunk
mov ecx, dword [0x6e92a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e92b0], eax
push str.beDeinitStream
mov edx, dword [0x6e92a8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e92b4], eax
push str.beCloseStream
mov eax, dword [0x6e92a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e92b8], eax
push str.beVersion
mov ecx, dword [0x6e92a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e92bc], eax
push str.beWriteVBRHeader
mov edx, dword [0x6e92a8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e92c0], eax
push str.beWriteInfoTag
mov eax, dword [0x6e92a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e92c4], eax
cmp dword [0x6e92ac], 0
je 0x53f1cd
cmp dword [0x6e92b0], 0
je 0x53f1cd
cmp dword [0x6e92b4], 0
je 0x53f1cd
cmp dword [0x6e92b8], 0
je 0x53f1cd
cmp dword [0x6e92bc], 0
je 0x53f1cd
cmp dword [0x6e92c0], 0
jne 0x53f1f7
mov ecx, dword [0x6e92a8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x6e92a8], 0
push str.Cannot_bind_functions_from_lame_enc.dll
push 1
mov ecx, dword [ebp - 4]
call fcn.00534510
xor eax, eax
jmp 0x53f20c
mov edx, dword [ebp - 4]
add edx, 0x3c
push edx
call dword [0x6e92bc]
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x541a70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x5eabd8]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jne 0x541aba
push str.MP3_Info_Tag_Reader_not_correctly_initialized
push 1
mov ecx, dword [ebp - 0xa8]
call fcn.00544600
xor eax, eax
jmp 0x541c35
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xa8]
call fcn.00541c50
test eax, eax
je 0x541adb
mov dword [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0xa8]
call fcn.00542050
test eax, eax
je 0x541af5
mov dword [ebp - 4], 1
push 0x5b8d48
lea eax, [ebp - 0xa4]
push eax
mov ecx, dword [ebp + 8]
call fcn.0052d910
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.0045fc40
add esp, 8
mov byte [ebp - 0x9d], al
lea ecx, [ebp - 0xa4]
call fcn.0041c360
movzx edx, byte [ebp - 0x9d]
test edx, edx
je 0x541c1f
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x14]
call eax
test eax, eax
je 0x541c1f
mov byte [ebp - 0x90], 0
push 0x87
push 0
lea ecx, [ebp - 0x8f]
push ecx
call fcn.004aeb90
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov ecx, dword [ebp - 0xa8]
add ecx, 0x10
call fcn.004368b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
je 0x541c1f
push 0
mov edx, dword [ebp - 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xffffffff
je 0x541c12
mov eax, dword [ebp - 0x98]
shl eax, 3
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, eax
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x1c]
cdq
mov esi, 0x3e8
idiv esi
mov esi, eax
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
imul eax, eax, 0x3e8
push eax
mov ecx, dword [ebp + 8]
call fcn.0052d8c0
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 4]
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004adaab
mov esp, ebp
pop ebp
ret 4
Function at 0x548670
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.WNASPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0xafa0a0], eax
cmp dword [0xafa0a0], 0
jne 0x548696
xor eax, eax
jmp 0x5487ec
push str.GetASPI32SupportInfo
mov eax, dword [0xafa0a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xafa09c], eax
cmp dword [0xafa09c], 0
jne 0x5486cc
push 0
push 0
push str.Cant_Find_GetASPI32SupportInfo_function.
call fcn.00480655
xor eax, eax
jmp 0x5487ec
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
or edx, 2
mov eax, dword [ebp + 8]
mov word [eax], dx
push str.SendASPI32Command
mov ecx, dword [0xafa0a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xafa098], eax
cmp dword [0xafa098], 0
jne 0x548712
push 0
push 0
push str.Cant_Find_SendASPI32Command_function.
call fcn.00480655
xor eax, eax
jmp 0x5487ec
mov edx, dword [ebp + 8]
movzx eax, word [edx]
or eax, 1
mov ecx, dword [ebp + 8]
mov word [ecx], ax
push str.GetASPI32Buffer
mov edx, dword [0xafa0a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xafa094], eax
cmp dword [0xafa094], 0
jne 0x548743
jmp 0x548752
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
or ecx, 4
mov edx, dword [ebp + 8]
mov word [edx], cx
push str.FreeASPI32Buffer
mov eax, dword [0xafa0a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xafa090], eax
cmp dword [0xafa090], 0
jne 0x548773
jmp 0x548782
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
or edx, 8
mov eax, dword [ebp + 8]
mov word [eax], dx
push str.TranslateASPI32Address
mov ecx, dword [0xafa0a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xafa08c], eax
cmp dword [0xafa08c], 0
jne 0x5487a4
jmp 0x5487b3
mov edx, dword [ebp + 8]
movzx eax, word [edx]
or eax, 0x10
mov ecx, dword [ebp + 8]
mov word [ecx], ax
call dword [0xafa09c]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
and edx, 0xffff
movzx eax, dx
shr eax, 8
and eax, 0xff
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
and ecx, 0xffff
movzx edx, cx
and edx, 0xff
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
mov esp, ebp
pop ebp
ret
Function at 0x562f50
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push esi
push eax
lea ecx, [esp + 0x10]
push 0x5a13b8
push ecx
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x34]
add esp, 0xc
lea eax, [esp + 4]
push eax
push str.SoftwareGreenTree_ApplicationsFreeRIPmgstat
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x562fc6
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x562fbb
lea esi, [eax + 1]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004adaab
add esp, 0x1c
ret 8

Function at 0x562fe0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
push esi
push eax
lea ecx, [esp + 0x18]
push 0x5a13b8
push ecx
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 8]
push edx
push str.SoftwareGreenTree_ApplicationsFreeRIPmgstat
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x563066
mov eax, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x56305b
mov esi, dword [esp + 4]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004adaab
add esp, 0x24
ret 4

Function at 0x563260
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi], vtable.CHttpClient.0
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov eax, 1
test ecx, ecx
je 0x563295
movsx eax, byte [ecx]
neg eax
sbb eax, eax
and eax, 3
mov edx, dword [esp + 0x10]
push 0
push edx
push ecx
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
jne 0x5632b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov eax, esi
pop esi
ret 0xc
Function at 0x563360
Capabilities:
Read data from internet
Receive data

Disassembly:
sub esp, 0x88
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x94]
push ebp
mov ebp, ecx
cmp dword [ebp + 0x10], 0
push edi
mov edi, dword [esp + 0x98]
jne 0x563391
xor eax, eax
jmp 0x5633ef
mov eax, dword [ebx]
push esi
push eax
xor esi, esi
push esi
push edi
call fcn.004aeb90
add esp, 0xc
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push 0x80
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x563409
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5633e7
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
call fcn.004ae820
mov eax, dword [esp + 0x1c]
add esi, eax
lea edx, [esi + 0x81]
add esp, 0xc
add edi, eax
cmp edx, dword [ebx]
jb 0x5633a1
mov eax, 1
mov dword [ebx], esi
pop esi
mov ecx, dword [esp + 0x90]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004adaab
add esp, 0x88
ret 8
xor eax, eax
jmp 0x5633ec