joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a2e80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0a33
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
call fcn.0057a5e0
add esp, 4
mov dword [ebp - 4], 0
push 0x627d04
lea ecx, [ebp - 0x14]
call fcn.0046ff60
lea ecx, [ebp - 0x14]
call fcn.00493020
push eax
push 0
push 0x627d30
push 0x627d3c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403270
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x5a5a50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.005a50e0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.005292cc
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.005294fd
add esp, 4
cmp eax, 0xffffffff
jne 0x5a5aab
mov edx, dword [ebp + 8]
push edx
call fcn.005294ce
add esp, 4
test eax, eax
je 0x5a5aab
push 0
push 0
push 5
mov ecx, dword [ebp - 0x14]
call fcn.005a48c0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
jmp 0x5a5b8b
push 2
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.005292cc
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.00529a83
add esp, 4
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.005292cc
add esp, 0xc
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5a5af9
push 0
push 0
push 5
mov ecx, dword [ebp - 0x14]
call fcn.005a48c0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x30]
jmp 0x5a5b8b
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x5a5b1b
push 0
push 0
push 0xf
mov ecx, dword [ebp - 0x14]
call fcn.005a48c0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
jmp 0x5a5b8b
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
call fcn.00521888
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x40]
push ecx
call fcn.005298d0
add esp, 0x10
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
je 0x5a5b70
push 0
push 0
push 5
mov ecx, dword [ebp - 0x14]
call fcn.005a48c0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
jmp 0x5a5b8b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x40]
mov eax, dword [ebp - 8]
mov byte [edx + eax], 0
mov ecx, dword [ebp - 0x14]
call fcn.005a59e0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x30]
mov esp, ebp
pop ebp
ret 4
Function at 0x5a7ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x5a7ad9
mov eax, dword [ebp + 8]
push eax
call fcn.00524b18
add esp, 4
test eax, eax
jne 0x5a7add
xor eax, eax
jmp 0x5a7aff
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 2
setne dl
mov eax, edx
pop ebp
ret

Function at 0x5a7b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddab5
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x234], 0
push 0x208
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.00524800
add esp, 0xc
mov dword [ebp - 0x10], 0x20a
lea ecx, [ebp - 0x18]
call fcn.00403290
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x629e58
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x14]
push eax
push 0x629e7c
mov ecx, dword [ebp - 0x1c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x5a7c51
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5a7d74
mov word [ebp - 0x2c], 0
cmp dword [ebp - 0x14], 1
jne 0x5a7c70
lea ecx, [ebp - 0x234]
push ecx
call fcn.00524b18
add esp, 4
test eax, eax
jne 0x5a7ca2
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5a7d74
lea ecx, [ebp - 0x234]
push ecx
call fcn.005a7ac0
add esp, 4
test eax, eax
jne 0x5a7ce7
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5a7d74
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040b1c0
push 1
lea edx, [ebp - 0x23c]
push edx
lea ecx, [ebp - 0x18]
call fcn.0048a680
mov dword [ebp - 0x244], eax
push 0x629e94
mov eax, dword [ebp - 0x244]
push eax
call fcn.0048a660
add esp, 8
mov byte [ebp - 0x235], al
lea ecx, [ebp - 0x23c]
call fcn.00403270
movzx ecx, byte [ebp - 0x235]
test ecx, ecx
je 0x5a7d47
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00466770
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret
Function at 0x5a83a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040ee60
movzx eax, al
test eax, eax
je 0x5a83b7
xor al, al
jmp 0x5a83f7
mov ecx, dword [ebp + 8]
call fcn.00493020
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5a83f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x5a83f5
mov ecx, dword [ebp + 8]
call fcn.00493020
push eax
call fcn.0057a6d0
add esp, 4
neg eax
sbb eax, eax
neg eax
jmp 0x5a83f7
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x5a8400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4185
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x14], 0
mov word [ebp - 0x234], 0
push 0x208
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.00524800
add esp, 0xc
mov dword [ebp - 0x10], 0x20a
lea ecx, [ebp - 0x18]
call fcn.00403290
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00497680
add esp, 4
mov byte [ebp - 4], 1
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x629e98
lea ecx, [ebp - 0x1c]
call fcn.00493020
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x5a84eb
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5a8632
mov word [ebp - 0x2c], 0
cmp dword [ebp - 0x14], 1
jne 0x5a850a
lea ecx, [ebp - 0x234]
push ecx
call fcn.00524b18
add esp, 4
test eax, eax
jne 0x5a8548
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5a8632
lea ecx, [ebp - 0x234]
push ecx
call fcn.005a7ac0
add esp, 4
test eax, eax
jne 0x5a8599
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5a8632
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040b1c0
push 1
lea edx, [ebp - 0x23c]
push edx
lea ecx, [ebp - 0x18]
call fcn.0048a680
mov dword [ebp - 0x244], eax
push 0x629eb0
mov eax, dword [ebp - 0x244]
push eax
call fcn.0048a660
add esp, 8
mov byte [ebp - 0x235], al
lea ecx, [ebp - 0x23c]
call fcn.00403270
movzx ecx, byte [ebp - 0x235]
test ecx, ecx
je 0x5a85f9
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00466770
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret
Function at 0x5a9670
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x5a96a2
xor eax, eax
jmp 0x5a972f
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x5a96c4
jmp 0x5a9722
mov eax, dword [ebp - 0x18]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5a96db
jmp 0x5a9722
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], 0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5a971e
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
xor edx, edx
test eax, eax
setge dl
mov dword [ebp - 4], edx
xor eax, eax
jne 0x5a96a9
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5ab5f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret
Function at 0x5ab930
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], 0
push str.WinTrust.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x5abaa6
push str.CryptCATAdminAcquireContext
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push str.CryptCATAdminReleaseContext
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
push str.CryptCATAdminCalcHashFromFileHandle
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
push str.CryptCATAdminEnumCatalogFromHash
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
push str.CryptCATCatalogInfoFromContext
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
push str.CryptCATAdminReleaseCatalogContext
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
push str.WinVerifyTrust
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
push str.WTHelperProvDataFromStateData
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
push str.WTHelperGetProvSignerFromChain
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
push str.WTHelperGetProvCertFromChain
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5aca90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
push str.KPopCenterImpl_Exist
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5acac8
mov dword [ebp - 8], 1
jmp 0x5acad8
cmp dword [ebp - 4], 0
je 0x5acad8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x5ad280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddc28
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
push 0x62c308
lea ecx, [ebp - 0x1c]
call fcn.004092b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 1
push 0
lea ecx, [ebp - 0x1c]
call fcn.00493020
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5ad304
jmp 0x5ad413
lea ecx, [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0x62c354
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5ad413
mov eax, dword [ebp - 0x18]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00521888
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x5ad35a
jmp 0x5ad413
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x24]
push edx
call fcn.00524800
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0x62c364
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5ad3af
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov word [edx + ecx*2], 0
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b1c0
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp + 8]
call fcn.0040ee60
movzx ecx, al
test ecx, ecx
je 0x5ad413
mov edx, dword [ebp - 0x18]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x24]
push eax
call fcn.00524800
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.Version
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5ad413
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov word [eax + edx*2], 0
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040b1c0
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x14], 0
je 0x5ad423
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], 0
je 0x5ad442
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00523d11
add esp, 4
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00403270
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5af8c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.00524800
add esp, 0xc
mov ecx, dword [ebp - 0x118]
call fcn.005aeea0
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x118]
cmp dword [edx + 0xc], 0
jne 0x5af934
mov ecx, dword [ebp - 0x118]
call fcn.005af770
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x118]
cmp dword [edx + 0xc], 0
jne 0x5af94a
jmp 0x5afad6
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x114]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x118]
cmp dword [edx + 0x10], 0xffffffff
jne 0x5af994
jmp 0x5afad6
mov eax, dword [ebp - 0x118]
cmp dword [eax + 0x30], 0
je 0x5af9c6
push 4
push 0x1000
push 0x40
push 0
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0x20], eax
jmp 0x5af9ea
push 4
push 0x1000
push 0x34
push 0
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0x1c], eax
push 4
push 0x1000
push 0x104
push 0
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0x24], eax
push 4
push 0x1000
push 0x10
push 0
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0x28], eax
push 4
push 0x1000
push 8
push 0
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp - 0x118]
cmp dword [edx + 0x1c], 0
jne 0x5afa71
mov eax, dword [ebp - 0x118]
cmp dword [eax + 0x20], 0
je 0x5afa95
mov ecx, dword [ebp - 0x118]
cmp dword [ecx + 0x24], 0
je 0x5afa95
mov edx, dword [ebp - 0x118]
cmp dword [edx + 0x28], 0
je 0x5afa95
mov eax, dword [ebp - 0x118]
cmp dword [eax + 0x2c], 0
jne 0x5afa99
jmp 0x5afad6
push 0x104
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x118]
call fcn.005aef10
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x118]
add ecx, 0x14
call fcn.0040c770
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 8], 1
mov edx, dword [ebp - 0x118]
cmp dword [edx + 8], 0
jne 0x5afaed
mov ecx, dword [ebp - 0x118]
call fcn.005aef70
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret 4
Function at 0x5afd80
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df12e
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.00524800
add esp, 0xc
mov dword [ebp - 0x10], 0x104
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x5afe14
push 0x62d8d0
mov ecx, dword [ebp + 8]
call fcn.004092b0
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 8]
jmp 0x5afeb0
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x228]
call fcn.004092b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.0045b180
lea ecx, [ebp - 0x228]
call fcn.0040ee60
movzx edx, al
test edx, edx
je 0x5afe7d
push str.defaultuser
mov ecx, dword [ebp + 8]
call fcn.004092b0
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5afeb0
lea ecx, [ebp - 0x228]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret

Function at 0x5b0210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x80004005
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
jne 0x5b0241
jmp 0x5b02b6
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc], 0
jne 0x5b0262
jmp 0x5b02b6
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x5b026e
jmp 0x5b02b6
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x5b0160
push 0
push 0
call fcn.005277fd
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call fcn.0048aa40
add esp, 8
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x5b02af
jmp 0x5b02b6
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4