joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52f1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
push esi
cmp eax, 0xffffffff
jne 0x52f1f0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x52f21b
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
push esi
jmp 0x52f1ff
lea ecx, [ebp - 4]
or eax, 0x20019
push ecx
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x52f21b
jle 0x52f266
movzx eax, ax
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
add eax, eax
mov dword [ebp - 8], 0
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x52f264
jle 0x52f25d
movzx esi, si
or esi, 0x80070000
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5312d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 0xaaaaaaab
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ecx*4 + 2]
mul ecx
mov ebx, dword [edi + 4]
mov ecx, ebx
mov esi, edx
mov edx, dword [edi]
shr esi, 1
sub ecx, edx
cmp esi, ecx
jae 0x531300
lea eax, [edx + esi]
jmp 0x53132a
jbe 0x53132d
mov eax, dword [edi + 8]
sub eax, edx
cmp esi, eax
jbe 0x531319
lea eax, [ebp + 0x13]
mov ecx, edi
push eax
push esi
call fcn.00522ab0
jmp 0x53132d
sub esi, ecx
push esi
push 0
push ebx
call fcn.00560a80
add esp, 0xc
lea eax, [esi + ebx]
mov dword [edi + 4], eax
mov edx, dword [edi]
mov esi, 8
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, edi
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], ecx
mov bl, byte [edi]
cmp edi, ecx
jae 0x5313c1
mov al, bl
cmp esi, 6
jbe 0x531359
and al, 0x3f
shr bl, 6
sub esi, 6
jmp 0x53138d
inc edi
cmp edi, ecx
jae 0x531362
mov bl, byte [edi]
jmp 0x531364
xor bl, bl
mov ecx, 6
sub ecx, esi
mov dword [ebp + 8], ecx
je 0x531387
mov dl, byte [ecx*4 + 0x5d90ac]
mov ecx, esi
and dl, bl
shl dl, cl
mov cl, byte [ebp + 8]
or al, dl
mov edx, dword [ebp + 0x10]
shr bl, cl
mov ecx, dword [ebp + 0xc]
add esi, 2
cmp al, 0xa
jae 0x531395
add al, 0x30
jmp 0x5313b7
cmp al, 0x24
jae 0x53139d
add al, 0x37
jmp 0x5313b7
cmp al, 0x3e
jae 0x5313a5
add al, 0x3d
jmp 0x5313b7
mov eax, 0x2d
mov ecx, 0x5f
cmove ecx, eax
mov al, cl
mov ecx, dword [ebp + 0xc]
mov byte [edx], al
inc edx
mov dword [ebp + 0x10], edx
cmp edi, ecx
jb 0x531348
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x531d80
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1050
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x248]
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x38]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x34]
push 2
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x218], 0
call fcn.00527490
push esi
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
push edi
push ebx
push dword [ebp + 0x28]
mov ebx, dword [ebp - 0x214]
mov ecx, ebx
push dword [ebp - 0x22c]
push dword [ebp + 0x20]
push dword [ebp - 0x230]
push dword [ebp - 0x234]
push dword [ebp - 0x238]
push dword [ebp - 0x23c]
call fcn.005316b0
test eax, eax
je 0x531f48
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00560a80
add esp, 0xc
mov dword [ebp - 0x240], 0x100
lea eax, [ebp - 0x240]
push 0
push eax
lea eax, [ebp - 0x210]
push eax
push 5
push dword [ebp - 0x218]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x531f48
cmp dword [ebp - 0x21c], 0
je 0x531f44
mov ebx, dword [ebp + 0x30]
test ebx, ebx
je 0x531f3e
lea eax, [ebp - 0x210]
push eax
call fcn.0057277d
mov edi, eax
add esp, 4
cmp edi, ebx
cmova edi, ebx
xor esi, esi
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x220]
push eax
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp - 0x21c]
add eax, esi
push eax
push dword [ebp - 0x218]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 0x220]
add esi, ecx
test eax, eax
je 0x531f28
test ecx, ecx
je 0x531f28
cmp esi, edi
jb 0x531ef3
mov eax, dword [ebp - 0x244]
mov ebx, dword [ebp - 0x214]
test eax, eax
je 0x531f44
mov dword [eax], esi
xor esi, esi
jmp 0x531f4d
mov ebx, dword [ebp - 0x214]
xor esi, esi
jmp 0x531f4d
mov esi, 0x80004005
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.005315f0
lea ecx, [ebp - 0x248]
call fcn.00527530
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret 0x34
Function at 0x532000
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b115e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x639354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00523330
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
call fcn.00523330
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00523330
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
call fcn.00523330
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 3
call fcn.00523330
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.00523330
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 5
call fcn.00523330
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 6
call fcn.00523330
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 7
call fcn.00523330
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 8
call fcn.00523330
lea ecx, [esi + 0xf0]
mov byte [ebp - 4], 9
call fcn.00523330
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 0xa
call fcn.00523330
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0xb
call fcn.00523330
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 0xc
call fcn.00523330
lea ecx, [esi + 0x150]
mov byte [ebp - 4], 0xd
call fcn.00523330
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 0xe
call fcn.00523330
lea ecx, [esi + 0x180]
mov byte [ebp - 4], 0xf
call fcn.00523330
lea ecx, [esi + 0x198]
mov byte [ebp - 4], 0x10
call fcn.00523330
mov dword [esi + 0x1b0], 0
mov eax, esi
mov dword [esi + 0x1b4], 0
mov dword [esi + 0x1b8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5391a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1e0d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
mov ebx, 0x7f
mov byte [ebp - 0x24], 0x3c
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x11
mov byte [ebp - 0x21], 0x7c
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x49
mov byte [ebp - 0x1e], 0x5e
mov byte [ebp - 0x1d], 0xd
mov byte [ebp - 0x1c], 0x7c
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x54
mov byte [ebp - 0x19], 0xd
mov byte [ebp - 0x18], 0x14
mov byte [ebp - 0x17], 0x36
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x4a
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x13], 0
cmp byte [ebp - 0x13], 0
jne 0x539250
mov byte [ebp - 0x13], 1
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0x24]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + ecx - 0x24], dl
inc ecx
cmp ecx, 0x10
jb 0x539230
lea ecx, [ebp - 0x24]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x539270
sub ecx, edx
lea eax, [ebp - 0x24]
push ecx
push eax
mov ecx, esi
call fcn.00438630
mov byte [ebp - 0x38], 0x49
mov byte [ebp - 0x37], 0x49
mov byte [ebp - 0x36], 0x21
mov byte [ebp - 0x35], 0x35
mov byte [ebp - 0x34], 0x21
mov byte [ebp - 0x33], 0x35
mov byte [ebp - 0x32], 0x11
mov byte [ebp - 0x31], 0x35
mov byte [ebp - 0x30], 0x68
mov byte [ebp - 0x2f], 0x7c
mov byte [ebp - 0x2e], 0x6f
mov byte [ebp - 0x2d], 0x6f
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x2c
mov byte [ebp - 0x29], 0x11
mov byte [ebp - 0x28], 0
mov al, byte [ebp - 0x38]
mov byte [ebp - 0x27], 0
cmp byte [ebp - 0x27], 0
mov dword [ebp - 4], 0
jne 0x539303
mov byte [ebp - 0x27], 1
xor ecx, ecx
mov al, byte [ebp + ecx - 0x38]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + ecx - 0x38], dl
inc ecx
cmp ecx, 0x10
jb 0x5392e3
lea edx, [ebp - 0x38]
mov dword [esi + 0x18], 0
mov dword [esi + 0x28], 0
lea ecx, [edx + 1]
mov dword [esi + 0x2c], 0xf
mov byte [esi + 0x18], 0
mov al, byte [edx]
inc edx
test al, al
jne 0x539322
sub edx, ecx
lea eax, [ebp - 0x38]
push edx
push eax
lea ecx, [esi + 0x18]
call fcn.00438630
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
Function at 0x53b670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2270
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x238], esi
test eax, eax
je 0x53b7db
test edi, edi
je 0x53b7db
xor ecx, ecx
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x234]
push ecx
push 0x20019
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x53b78f
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00560a80
add esp, 0xc
mov dword [ebp - 0x23c], 0x208
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
push 0
push edi
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x53b783
cmp dword [ebp - 0x238], 1
jne 0x53b783
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x53b761
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.0042e330
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.0043f4c0
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x53b7f4
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x53b7cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x53b813
push edx
push ecx
call fcn.0055c524
add esp, 8
jmp 0x53b7f4
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret 0xc
call fcn.0056af64
int3
Function at 0x53cf40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b246d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x639354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x643b98]
test esi, esi
jne 0x53cf86
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push esi
xor bl, bl
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0
cmp byte [0x643b9c], bl
jne 0x53d13f
cmp dword [0x643b94], 0
je 0x53d13f
cmp dword [0x643b7c], 0
je 0x53d13f
cmp dword [0x643b90], 0
je 0x53d13f
cmp dword [0x643b48], 0
je 0x53d13f
cmp dword [0x643b44], 0
je 0x53d13f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0
push str.SOFTWAREPdfRegUnHook
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x53d13f
call fcn.0053f850
call fcn.00541bb0
call fcn.00542070
call fcn.00540de0
call fcn.0053de30
push 0x53d310
push 0x643b94
call fcn.005439c0
mov ebx, eax
push 0x53d160
push 0x643b7c
mov dword [ebp - 0x20], ebx
call fcn.005439c0
xor edi, edi
mov dword [ebp - 0x10], eax
add esp, 0x10
cmp dword [0x643b2c], edi
je 0x53d06d
push 0x53d450
push 0x643b2c
call fcn.005439c0
add esp, 8
mov edi, eax
cmp dword [0x643b40], 0
mov dword [ebp - 0x14], 0
je 0x53d092
push 0x53d5a0
push 0x643b40
call fcn.005439c0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [0x643b44], 0
mov dword [ebp - 0x18], 0
je 0x53d0b7
push 0x53d910
push 0x643b44
call fcn.005439c0
add esp, 8
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x53d0d9
cmp dword [ebp - 0x10], 0
je 0x53d0d9
cmp dword [0x643b2c], 0
je 0x53d0ce
test edi, edi
je 0x53d0d9
mov byte [0x643b9c], 1
mov bl, 1
jmp 0x53d13f
xor bl, bl
mov byte [0x643b9c], 0
cmp dword [ebp - 0x20], 0
je 0x53d0f5
push 0x643b94
call fcn.00543e30
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x53d108
push 0x643b7c
call fcn.00543e30
add esp, 4
test edi, edi
je 0x53d119
push 0x643b2c
call fcn.00543e30
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x53d12c
push 0x643b40
call fcn.00543e30
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x53d13f
push 0x643b44
call fcn.00543e30
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x543e30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
cmp dword [0x643bac], ebx
jne 0x543e57
push 0x643bb0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x643bac], 1
push 0x643bb0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x643bc8]
test esi, esi
je 0x543f80
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
lea eax, [esi + 0x30]
cmp eax, ecx
je 0x543e97
mov esi, dword [esi]
test esi, esi
jne 0x543e76
pop edi
push 0x643bb0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 8]
push dword [esi + 4]
call fcn.00544070
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push dword [esi + 8]
mov dword [ebp - 4], ebx
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x543f7a
mov eax, dword [esi + 8]
xor ecx, ecx
mov edx, dword [esi + 4]
test eax, eax
je 0x543eea
mov al, byte [esi + ecx + 0x50]
mov byte [ecx + edx], al
inc ecx
mov eax, dword [esi + 8]
cmp ecx, eax
jb 0x543ed8
mov edx, dword [esi + 4]
mov ebx, dword [ebp - 0xc]
push eax
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [esi + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [edi], eax
mov edi, dword [0x643bc8]
mov dword [ebp - 0xc], 1
test edi, edi
je 0x543f75
cmp edi, esi
je 0x543f33
mov ebx, edi
mov edi, dword [edi]
test edi, edi
jne 0x543f22
mov ebx, dword [ebp - 0xc]
jmp 0x543f7a
test ebx, ebx
jne 0x543f49
mov eax, dword [edi]
dec dword [0x643bcc]
mov ebx, dword [ebp - 0xc]
mov dword [0x643bc8], eax
jmp 0x543f7a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x70
push ebx
call esi
mov eax, dword [edi]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x70
push ebx
call esi
dec dword [0x643bcc]
mov ebx, dword [ebp - 0xc]
jmp 0x543f7a
mov ebx, 1
call fcn.00543fa0
pop edi
push 0x643bb0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x543fa0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x643bd4], esi
jbe 0x543ff6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x643bd0]
push dword [eax + esi*4]
call ebx
mov eax, dword [0x643bd0]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x643bd4]
jb 0x543fd4
pop ebx
push dword [0x643bd0]
call fcn.0056a8c4
add esp, 4
mov dword [0x643bd0], 0
mov dword [0x643bd4], 0
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5442f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x643bc8]
xor ebx, ebx
test esi, esi
je 0x544364
mov ecx, dword [ebp + 8]
cmp esi, ecx
je 0x544317
mov ebx, esi
mov esi, dword [esi]
test esi, esi
jne 0x544305
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x544324
mov eax, dword [esi]
mov dword [0x643bc8], eax
jmp 0x54434a
lea eax, [ebp - 4]
push eax
push 0x40
push 0x70
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
mov dword [ebx], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x70
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x54435e
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
dec dword [0x643bcc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x558e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0055cc70
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x1008]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push edx
push 0x20219
push 0
push eax
push ecx
mov dword [ebp - 0x1008], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x558f43
push 0x1000
push eax
mov dword [ebp - 0x100c], eax
lea eax, [ebp - 0x1004]
push eax
call fcn.00560a80
add esp, 0xc
mov dword [ebp - 0x1010], 0x1000
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0
push esi
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1008]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x558f01
cmp dword [ebp - 0x100c], 1
jne 0x558f43
lea edx, [ebp - 0x1004]
lea esi, [edx + 2]
lea ebx, [ebx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x558f10
sub edx, esi
lea eax, [ebp - 0x1004]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.0042e330
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
Function at 0x55b850
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x55b93f
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
test esi, esi
je 0x55b924
cmp esi, 0x104
jae 0x55b924
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x55b92c
cmp dword [ebp - 0x210], 0
mov ecx, str.System32_s
push edi
mov eax, 0x5de390
cmove eax, ecx
push eax
push 0x1800
push 0
mov eax, 0x104
sub eax, esi
push 0
push eax
lea eax, [ebp - 0x20c]
lea eax, [eax + esi*2]
push eax
call fcn.0049d480
add esp, 0x1c
test eax, eax
js 0x55b924
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x55b93f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret

Function at 0x5853a3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00585054

Function at 0x5853ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005851de

Function at 0x58928f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00589211
Function at 0x5967e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.00560a80
add esp, 0xc
mov dword [ebp - 0x210], 0x208
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.InfoHD
push str.SoftwareKingsoftOffice6.0Common
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x596870
xor eax, eax
mov word [esi], ax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, esi
mov word [esi], ax
mov eax, dword [ebp - 0x210]
shr eax, 1
dec eax
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042e330
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
Function at 0x599ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.00560a80
add esp, 0xc
mov dword [ebp - 0x210], 0x208
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.InfoHD3_C
push str.SoftwareKingsoftOffice6.0Common
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x599b70
xor eax, eax
mov word [esi], ax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, esi
mov word [esi], ax
mov eax, dword [ebp - 0x210]
shr eax, 1
dec eax
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042e330
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret