joyce8/EMBER2024-capa huggingface dataset:
Function at 0x533803
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
mov byte [ebp - 8], 0x4a
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x36
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x32
mov byte [ebp - 0xf], 0x30
mov byte [ebp - 0xe], 0x32
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 0xc], bl
xor esi, esi
mov ecx, dword [esi*4 + 0x6a52f0]
lea eax, [ebp - 8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x533867
cmp dl, bl
je 0x533863
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x533867
inc eax
inc eax
inc ecx
inc ecx
cmp dl, bl
jne 0x533849
xor eax, eax
jmp 0x53386c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x533878
inc esi
cmp esi, 0xc
jl 0x53383f
jmp 0x53387b
lea edi, [esi + 1]
lea eax, [ebp - 4]
push eax
call fcn.005f8585
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.005f8585
pop ecx
pop ecx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.00533620
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x533943
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push 0x3e8
push eax
lea esi, [ebp - 4]
call fcn.00401fed
cmp dword [ebp - 4], 0xffffffff
je 0x533a2b
push ebx
mov ebx, dword [edi + 0x219]
test ebx, ebx
je 0x5339f6
lea eax, [ebx + 4]
push eax
push str.__s__r_n
mov eax, 0x228
lea edi, [ebp - 0x454]
call fcn.005383cd
pop ecx
pop ecx
mov eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.00538038
mov esi, dword [ebx + 0x20c]
jmp 0x5339db
lea eax, [esi + 0x20c]
push eax
lea eax, [esi + 4]
push eax
push str._s_s_r_n
mov eax, 0x228
lea edi, [ebp - 0x454]
call fcn.005383cd
add esp, 0xc
mov eax, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.00538038
test esi, esi
je 0x5339df
mov esi, dword [esi]
test esi, esi
jne 0x5339a6
push 0x6449b0
lea eax, [ebp - 4]
push eax
call fcn.00538038
mov ebx, dword [ebx]
test ebx, ebx
jne 0x533977
mov edi, dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi + 4]
push esi
call fcn.00401f09
push esi
mov dword [edi + 0x211], eax
call fcn.00401d1e
mov dword [edi + 0x215], eax
mov byte [edi + 0x210], 0
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x533f0c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x6a5fb0]
sub esp, 0x410
cmp eax, 0xffffffff
je 0x533f2d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x6a5fb0], 0xffffffff
push esi
push edi
push 0x6a5da8
call fcn.00401d4e
lea eax, [ebp - 0x410]
call fcn.005366fc
mov edi, str..dmp
push edi
push str.PicoPDF_IP_794687
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
call fcn.0053768f
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x208]
push eax
call esi
push edi
push str.PicoPDF_HM_794687
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
call fcn.0053768f
lea eax, [ebp - 0x208]
push eax
call esi
pop edi
pop esi
leave
ret
Function at 0x5351c6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
xor ebx, ebx
cmp dword [esi], ebx
je 0x535387
cmp dword [esi + 4], ebx
jne 0x5351ed
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x535387
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push eax
call edi
push str.SymCleanup
push dword [esi + 4]
mov dword [esi + 0x2c], eax
call edi
push str.StackWalk64
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push str.SymGetOptions
push dword [esi + 4]
mov dword [esi + 0x38], eax
call edi
push str.SymSetOptions
push dword [esi + 4]
mov dword [esi + 0x24], eax
call edi
push str.SymFunctionTableAccess64
push dword [esi + 4]
mov dword [esi + 0x34], eax
call edi
push str.SymGetLineFromAddr64
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push str.SymGetModuleBase64
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push str.SymGetModuleInfo64
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
invalid
Function at 0x53666e
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
lea esi, [ebx + 0x7f]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
shr esi, 7
jmp 0x53669f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x5366b1
cmp ebx, esi
jbe 0x5366b1
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, esi
add esi, esi
push 3
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
je 0x536685
mov al, 1
jmp 0x5366b3
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x536821
Capabilities:
Get common file path

Disassembly:
xor ecx, ecx
push eax
push ecx
push ecx
push 2
push ecx
mov word [eax], cx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
ret

Function at 0x537c3e
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push edi
mov edi, ecx
cmp word [edi], 0
jne 0x537c57
xor al, al
jmp 0x537cd8
push esi
mov ecx, 0x631b08
mov eax, edi
lea esi, [ebp - 0x254]
call fcn.00401e87
jmp 0x537cc1
lea eax, [ebp - 0x254]
call fcn.00401ee5
test al, al
jne 0x537cb6
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0x45c]
push eax
call fcn.00401f51
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x537ca9
lea ecx, [ebp - 0x45c]
call fcn.00537c3e
jmp 0x537cb6
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x254]
call fcn.00401ec4
cmp dword [ebp - 0x254], 0xffffffff
jne 0x537c6c
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
leave
ret

Function at 0x537cdb
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
mov ebx, ecx
cmp word [ebx], 0
push edi
mov edi, edx
jne 0x537cf7
xor al, al
jmp 0x537dad
push esi
mov ecx, 0x631b08
mov eax, ebx
lea esi, [ebp - 0x258]
call fcn.00401e87
jmp 0x537d64
lea eax, [ebp - 0x258]
call fcn.00401ee5
test al, al
jne 0x537d59
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x460]
push eax
call fcn.00401f51
mov eax, dword [ebp - 0x254]
shr eax, 4
test al, 1
je 0x537d4b
mov edx, edi
lea ecx, [ebp - 0x460]
call fcn.00537cdb
jmp 0x537d59
lea eax, [ebp - 0x460]
push eax
mov eax, edi
call fcn.00536630
lea esi, [ebp - 0x258]
call fcn.00401ec4
cmp dword [ebp - 0x258], 0xffffffff
jne 0x537d0c
lea esi, [edi + 0x7f]
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
shr esi, 7
jmp 0x537d9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x537daa
cmp eax, 3
je 0x537daa
cmp dword [ebp - 4], esi
jbe 0x537daa
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 4], esi
add esi, esi
push ebx
call edi
test eax, eax
je 0x537d7e
mov al, 1
jmp 0x537dac
xor al, al
pop esi
pop edi
pop ebx
leave
Function at 0x537db1
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push edi
mov edi, ecx
cmp word [edi], 0
jne 0x537dca
xor al, al
jmp 0x537e5d
push esi
mov ecx, 0x631b08
mov eax, edi
lea esi, [ebp - 0x254]
call fcn.00401e87
jmp 0x537e46
lea eax, [ebp - 0x254]
call fcn.00401ee5
test al, al
jne 0x537e3b
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0x45c]
push eax
call fcn.00401f51
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x537e1c
lea ecx, [ebp - 0x45c]
call fcn.00537db1
jmp 0x537e3b
push 0x80
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x254]
call fcn.00401ec4
cmp dword [ebp - 0x254], 0xffffffff
jne 0x537ddf
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
leave
ret

Function at 0x5383e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push 1
xor esi, esi
push esi
push esi
push dword [ebp + 8]
push str.explore
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jae 0x538484
call fcn.00538682
test al, al
je 0x538484
push edi
push dword [ebp + 8]
mov eax, 0x104
push str.explorer.exe___s_
lea edi, [ebp - 0x25c]
call fcn.005383cd
push 0x44
pop edi
push edi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.005fc0d0
mov dword [ebp - 0x54], edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x25c]
push esi
push 0x10
push esi
push esi
push esi
push eax
push esi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
leave
ret 4

Function at 0x538489
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push dword [ebp + 8]
mov eax, 0x104
push str.explorer.exe__select___s_
lea edi, [ebp - 0x25c]
call fcn.005383cd
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.005fc0d0
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov word [ebp - 0x24], ax
mov dword [ebp - 0x54], edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x10
push esi
push esi
push esi
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
leave
ret 4
Function at 0x538508
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
and word [ebp - 0x214], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x214]
push eax
push 0
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
mov eax, dword [ebp - 8]
jne 0x53855e
cmp dword [eax + 0xc], 2
jne 0x53855e
mov byte [ebp - 1], 1
test eax, eax
je 0x538568
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov al, byte [ebp - 1]
leave
ret

Function at 0x538794
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x538837
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
push edi
cmp dword [ebp - 8], ebx
jne 0x538828
mov edi, dword [ebp + 8]
shr edi, 1
lea eax, [edi + 1]
push eax
call fcn.00496cd5
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
shr eax, 1
cmp eax, edi
ja 0x5387d2
mov ecx, dword [esi]
mov word [ecx + eax*2], bx
mov ecx, dword [esi]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, bx
jne 0x538813
sub eax, edx
sar eax, 1
mov dword [esi + 4], eax
mov word [ecx + eax*2], bx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
pop edi
je 0x538845
push 0x631a7c
call fcn.00496a9d
xor al, al
jmp 0x538847
mov al, 1
pop esi
pop ebx
leave
ret 8

Function at 0x5388d7
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
xor eax, eax
push eax
push 1
mov ebx, str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
push eax
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call edi
test eax, eax
jne 0x53890c
push 8
push 1
push ebx
xor ebx, ebx
push ebx
push esi
call edi
test eax, eax
je 0x538960
jmp 0x53890e
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x8003
push dword [esi]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x538960
push ebx
push 0xa
push str.nchkqxllib
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x538960
lea eax, [esi + 4]
push eax
push 1
push dword [ebp - 4]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x538960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, esi
pop ebx
leave
ret
Function at 0x53899b
Capabilities:
Encrypt or decrypt via wincrypt
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push dword [ebp + 0x14]
mov esi, 0x104
lea edi, [ebp - 0x110]
call fcn.004016da
mov eax, edi
lea esi, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5389c1
sub eax, esi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push ebx
push ebx
push dword [eax + 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x5389ef
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push eax
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x14]
push eax
push ebx
push ebx
push 1
push ebx
push dword [ebp - 8]
call esi
test eax, eax
jne 0x538a1b
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov al, bl
jmp 0x5389e8
mov eax, dword [ebp - 4]
cmp dword [ebp + 0x14], eax
ja 0x538a26
mov dword [ebp + 0x14], eax
push dword [ebp + 0x14]
call fcn.005f833c
push dword [ebp - 4]
mov edi, eax
lea eax, [ebp - 0x110]
push eax
push edi
call fcn.005fbd60
add esp, 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 1
push ebx
push dword [ebp - 8]
call esi
test eax, eax
je 0x538a96
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x538a96
push dword [ebp - 4]
push edi
push 3
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
push edi
call fcn.005f858a
pop ecx
jmp 0x538a0e
Function at 0x538aa2
Capabilities:
Encrypt or decrypt via wincrypt
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x538acc
xor al, al
jmp 0x538bc6
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push ebx
push ebx
push dword [eax + 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x538aed
mov eax, dword [ebp + 0x18]
mov word [eax], bx
jmp 0x538ac5
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp - 4]
mov byte [ebp + 0x13], bl
mov dword [ebp + 8], 3
mov dword [ebp + 0xc], ebx
call esi
test eax, eax
jne 0x538ba8
push dword [ebp + 0xc]
call fcn.005f833c
pop ecx
mov edi, eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x538ba8
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push 1
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x538ba8
mov esi, 0x104
cmp dword [ebp + 0xc], esi
jb 0x538b66
mov dword [ebp + 0xc], 0x103
push dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.005fbd60
mov eax, dword [ebp + 0xc]
add esp, 0xc
push esi
mov esi, dword [ebp + 0x18]
push esi
push 0xffffffffffffffff
mov byte [ebp + eax - 0x10c], bl
lea eax, [ebp - 0x10c]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [esi + 0x206], bx
mov byte [ebp + 0x13], 1
push edi
call fcn.005f858a
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x538ea3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
push dword [ebp + 0x10]
mov word [eax], si
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x62c]
mov dword [eax], esi
mov dword [ebp - 0xc], esi
call fcn.00531c88
lea eax, [ebp - 0x10]
push eax
mov eax, edi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x538ee9
xor al, al
jmp 0x53905f
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x424]
push eax
push esi
push esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 0x10]
mov ebx, 0x104
mov edi, 0x208
mov dword [ebp + 0x10], ebx
mov word [ebp - 0x424], si
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
mov dword [ebp - 4], 1
jne 0x53905c
cmp word [ebp - 0x21c], si
je 0x538f43
cmp dword [ebp + 0x10], esi
je 0x538f43
inc dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x424]
push eax
push esi
push esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 4]
mov dword [ebp + 0x10], ebx
push dword [ebp - 0x10]
mov word [ebp - 0x424], si
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 4]
cmp eax, esi
je 0x538f32
cmp dword [ebp - 0xc], esi
je 0x53905c
call fcn.00538326
cdq
idiv dword [ebp - 0xc]
mov dword [ebp + 0x10], ebx
mov word [ebp - 0x424], si
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x424]
push eax
push esi
push esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push edx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x538fe8
mov edi, dword [ebp + 0x14]
mov ecx, dword [edi]
xor ebx, ebx
jmp 0x538fe2
lea eax, [ebp - 0x21c]
call fcn.0040106b
test eax, eax
je 0x538fe8
inc ebx
mov ecx, dword [edi + ebx*4]
cmp ecx, esi
jne 0x538fcf
jmp 0x538fff
call fcn.00538326
cdq
idiv dword [ebp - 0xc]
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jb 0x538f9d
cmp dword [ebp - 0x14], esi
jne 0x53905c
cmp word [ebp - 0x21c], si
je 0x53905c
cmp dword [ebp + 0x10], esi
je 0x53905c
movzx eax, word [ebp - 0x21c]
xor ecx, ecx
lea edx, [ebp - 0x21a]
cmp ecx, 0x103
jae 0x539036
mov edi, dword [ebp + 8]
mov word [edi + ecx*2], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
cmp ax, si
jne 0x53901c
mov eax, dword [ebp + 8]
mov word [eax + ecx*2], si
lea eax, [ebp - 0x424]
push eax
call fcn.005f9ab3
pop ecx
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x10]
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x53905e
xor al, al
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x539570
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
cmp dword [esi + 0x208], ebx
je 0x53958b
mov al, 1
jmp 0x539619
movzx eax, word [esi]
xor ecx, ecx
lea edx, [esi + 2]
jmp 0x5395ab
cmp ecx, 0x103
jae 0x5395b0
mov word [ebp + ecx*2 - 0x208], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
cmp ax, bx
jne 0x539595
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov word [ebp + ecx*2 - 0x208], bx
jmp 0x5395de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x539616
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 8], 0x32
jbe 0x539616
sub dword [ebp + 8], 0x32
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x208], eax
je 0x5395c1
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x53961e
push dword [esi + 0x208]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x208], ebx
xor al, al
pop edi
pop ebx
leave
ret 4
mov al, 1
jmp 0x539618
Function at 0x53a927
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and word [ebp - 0x210], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp word [ebp - 0x210], 0
movzx eax, word [ebp - 0x210]
mov edx, 0x1234
mov dword [esi], edx
lea ecx, [ebp - 0x20e]
je 0x53a97f
movzx eax, ax
add edx, eax
movzx eax, word [ecx]
inc ecx
inc ecx
test ax, ax
jne 0x53a96e
mov dword [esi], edx
and dword [esi], 0x7fffffff
lea eax, [ebp - 8]
push eax
mov dword [edi], 0x5678
call fcn.0057d522
mov eax, dword [edi]
xor ecx, ecx
movzx edx, byte [ebp + ecx - 8]
add eax, edx
inc ecx
cmp ecx, 6
jb 0x53a998
mov dword [edi], eax
leave
ret
Function at 0x53bc6e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x6ac300]
sub esp, 0x618
test eax, eax
je 0x53bc8c
xor ecx, ecx
cmp eax, 2
sete cl
mov al, cl
leave
ret
push 0
call fcn.005f83ff
sub eax, 0x65a61842
cmp eax, 0x5a497a0
pop ecx
jle 0x53bcae
mov dword [0x6ac300], 1
xor al, al
leave
ret
and word [ebp - 0x208], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 0x208], 0
jne 0x53bcea
lea eax, [ebp - 0x208]
push eax
mov eax, 0x665d34
call fcn.00401050
push esi
push edi
lea esi, [ebp - 0x410]
call fcn.004cc9e0
mov eax, dword [0x6a53c0]
test eax, eax
mov ecx, 0x6a53c0
mov esi, ecx
je 0x53bd8f
mov edi, ecx
lea ecx, [ebp - 0x208]
add edi, 0x10
call fcn.0040106b
test eax, eax
jne 0x53bd31
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x410]
call fcn.0040106b
test eax, eax
je 0x53bd3b
mov eax, dword [edi]
test eax, eax
mov esi, edi
jne 0x53bd0d
jmp 0x53bd8f
lea eax, [ebp - 0x618]
push eax
push 0x631a7c
push str.InstCountry
push str.Software
call fcn.00531ec3
mov ecx, dword [esi]
lea eax, [ebp - 0x618]
call fcn.0040106b
test eax, eax
jne 0x53bd8f
call fcn.004021b8
mov edx, dword [esi + 8]
mov ecx, 0xe10
neg eax
sub edx, ecx
cmp eax, edx
jl 0x53bd8f
mov edx, dword [esi + 0xc]
add edx, ecx
cmp eax, edx
mov dword [0x6ac300], 2
jle 0x53bd99
mov dword [0x6ac300], 1
xor eax, eax
cmp dword [0x6ac300], 2
pop edi
sete al
pop esi
leave
ret