joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f22b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64255b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x430], 0
push 0x404
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x420], 0
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call fcn.005d3370
mov esi, eax
mov dword [ebp - 0x428], esi
test esi, esi
jne 0x5f2366
push 2
push eax
push edi
call fcn.005d3370
mov esi, eax
mov dword [ebp - 0x428], eax
test esi, esi
jne 0x5f2366
call fcn.005ef770
mov edi, eax
jmp 0x5f2454
push dword [ebp - 0x424]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x5f2384
call fcn.005ef770
jmp 0x5f2447
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x5f23a2
call fcn.005ef770
jmp 0x5f2447
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x42c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x5f23c3
mov edi, 0x8007000e
jmp 0x5f2449
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x420]
push eax
lfence
call fcn.005ef540
jmp 0x5f23f0
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
jne 0x5f2407
mov edi, 0x8007000e
jmp 0x5f2449
push edi
lfence
push dword [ebp - 0x420]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x5f242a
call fcn.005ef770
jmp 0x5f2447
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x420]
call fcn.005f2100
mov edi, eax
test esi, esi
je 0x5f2454
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x5f246d
lea ecx, [ebp - 0x420]
call fcn.005f0ac0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5f3050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x641190
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6ccc30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x5f3093
lea eax, [edx + 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, edx
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5f30a0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5fa700
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push 0x6514c0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5fa74f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5fa789
push str.Application
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret
Function at 0x5faab0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x642d9b
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x428], ecx
mov eax, dword [ebp + 8]
lea esi, [ecx + 8]
push esi
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x438], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp - 0x424]
mov dword [ebp - 4], 0
test edi, edi
je 0x5fabaf
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0061e8c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jle 0x5fabaf
cmp eax, 0x103
jae 0x5fabaf
lea eax, [ebp - 0x218]
push 0x6518f0
push eax
call fcn.005d3f0e
add esp, 8
test eax, eax
jne 0x5fabaf
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lfence
call fcn.0061e8c0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x5fabaf
cmp eax, 0x103
jae 0x5fabaf
lea eax, [ebp - 0x420]
push str.swBrowser
push eax
call fcn.005d3f0e
add esp, 8
test eax, eax
sete bl
jmp 0x5fabb1
xor bl, bl
mov edi, dword [ebp - 0x428]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x434]
push eax
lea ecx, [edi + 0x38]
call fcn.005e3090
mov ecx, dword [ebp - 0x42c]
cmp byte [ecx + 0xd], 0
jne 0x5fabe4
mov eax, dword [ebp - 0x424]
cmp eax, dword [ecx + 0x10]
jae 0x5fac56
cmp dword [edi + 0x3c], 0xaaaaaaa
je 0x5fac85
mov eax, dword [ebp - 0x428]
mov edi, dword [edi + 0x38]
add eax, 0x38
mov dword [ebp - 0x440], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x43c], 0
push 0x18
lfence
call fcn.005d0220
mov ecx, dword [ebp - 0x424]
add esp, 4
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x428]
push eax
push dword [ebp - 0x430]
mov byte [eax + 0x14], 0
push dword [ebp - 0x434]
mov dword [eax], edi
lea ecx, [ecx + 0x38]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov word [eax + 0xc], 0
call fcn.005d6960
mov ecx, eax
mov byte [ecx + 0x14], bl
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret 4
call fcn.005e8c80
int3
Function at 0x5fb3f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x642e20
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x440], ax
lea eax, [ebp - 0x440]
push eax
push 1
push 0
push str.4021007
call fcn.005d4510
add esp, 0x10
movzx eax, ax
cmp word [ebp - 0x440], 0
je 0x5fb469
lea eax, [ebp - 0x440]
push eax
push 0
push 0
push str.4021007
call fcn.005d4510
add esp, 0x10
movzx eax, ax
test ax, ax
jne 0x5fb475
xor al, al
jmp 0x5fb629
xor bl, bl
test esi, esi
je 0x5fb627
cmp esi, 0xffff
je 0x5fb627
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5fb627
cmp dword [0x6ceea8], 0
je 0x5fb627
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x5fb627
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x5fb627
cmp eax, dword [0x6ceea8]
jne 0x5fb627
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0061e8c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jle 0x5fb627
cmp eax, 0x103
jae 0x5fb627
push dword [0x6c8544]
lea eax, [ebp - 0x218]
push eax
call fcn.005d3f0e
add esp, 8
test eax, eax
jne 0x5fb627
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lfence
call fcn.0061e8c0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
test esi, esi
jle 0x5fb592
cmp esi, 0x103
jae 0x5fb627
push dword [0x6c8540]
lea eax, [ebp - 0x420]
push eax
call fcn.005d3f0e
add esp, 8
test eax, eax
je 0x5fb5a7
test esi, esi
jne 0x5fb627
mov eax, dword [0x6c8540]
cmp word [eax], 0
jne 0x5fb627
push dword [ebp - 0x43c]
lea eax, [ebp - 0x438]
push eax
call fcn.00499110
add esp, 8
cmp dword [ebp - 0x428], 0
mov dword [ebp - 4], 0
je 0x5fb602
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push dword [0x6c8548]
cmovae eax, dword [ebp - 0x438]
push eax
call fcn.005d3f0e
add esp, 8
test eax, eax
jne 0x5fb602
lea ecx, [ebp - 0x438]
mov bl, 1
call fcn.005d4a10
jmp 0x5fb627
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 4], 1
cmp ecx, 8
jb 0x5fb627
inc ecx
push ecx
push dword [ebp - 0x438]
lea ecx, [ebp - 0x438]
call fcn.005d31d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret
Function at 0x5fcf80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x642f68
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6ccc30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
mov dword [edi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x24]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x14], eax
mov al, byte [ebp + 0x28]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], ebx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], esi
mov byte [edi + 0x20], al
mov dword [edi + 0x30], 0
test al, al
jne 0x5fd066
xor ecx, ecx
test esi, esi
je 0x5fd024
add edx, 0xc
mov eax, ecx
lea edx, [edx + 0x10]
mov ecx, dword [edx - 0x10]
cmp ecx, eax
cmovbe ecx, eax
sub esi, 1
jne 0x5fd012
mov eax, 0x100000
cmp ecx, eax
cmova ecx, eax
mov dword [edi + 0x28], ecx
lea eax, [ecx + 0xa]
push eax
call fcn.005d8940
mov esi, eax
add esp, 4
mov eax, dword [edi + 0x24]
cmp eax, esi
je 0x5fd052
push eax
call fcn.005db8b4
add esp, 4
mov dword [edi + 0x24], esi
push 0
call fcn.005db8b4
add esp, 4
cmp dword [edi + 0x24], 0
je 0x5fd11b
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov eax, ebx
mov edx, 0x40
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.005d8940
add esp, 4
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x5fd0b7
push 0x5fd3e0
push 0x5fcf20
push dword [ebp + 0x14]
mov dword [eax], ebx
lea ebx, [eax + 4]
push 0x40
push ebx
call fcn.0061cbbe
jmp 0x5fd0b9
xor ebx, ebx
mov eax, dword [edi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x5fd0fa
test eax, eax
je 0x5fd0f5
push 0x5fd3e0
push dword [eax - 4]
lea esi, [eax - 4]
mov byte [ebp - 4], 3
push 0x40
push eax
call fcn.0061cc32
mov eax, dword [esi]
shl eax, 6
add eax, 4
push eax
push esi
call fcn.0061cd47
add esp, 8
mov byte [ebp - 4], 1
mov dword [edi + 0x2c], ebx
mov eax, ebx
test eax, eax
je 0x5fd11b
mov ecx, edi
call fcn.005fd640
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
lea ecx, [ebp - 0x1c]
call fcn.005fd140
push 0x6bfafc
lea eax, [ebp - 0x1c]
push eax
call fcn.0061df07
int3
Function at 0x5fdc40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 4], 0
jg 0x5fdc88
jl 0x5fdc6c
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0x7fffffff
ja 0x5fdc88
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
jg 0x5fdc8d
jl 0x5fdc88
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0x80000001
jae 0x5fdc8d
jmp 0x5fdd2c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 8]
test eax, eax
je 0x5fdca9
mov dword [ebp - 0x1c], 0
jmp 0x5fdcb0
mov dword [ebp - 0x1c], 2
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x5fdd2c
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0xc]
jae 0x5fdd2c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp + 0x14]
push eax
call fcn.005fc800
add esp, 8
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5fdd1f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x5fdd21
jmp 0x5fdd2c
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
jmp 0x5fdccf
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret
Function at 0x5fe570
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x19], 0
jne 0x5fe5c0
cmp dword [edi + 0x1c], 0xffffffff
jne 0x5fe5c0
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x5fe59e
mov eax, dword [edi]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi + 0x1c], eax
sete al
mov byte [edi + 0x19], al
mov ecx, dword [edi + 0x1c]
cmp ecx, 0xffffffff
je 0x5fe69d
cmp byte [esi], 0
jne 0x5fe69d
mov eax, dword [esi + 4]
test eax, eax
jne 0x5fe5fa
push eax
push eax
push eax
movzx eax, byte [ebp + 0x10]
shl eax, 0x18
add eax, 2
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x5fe61f
cmp dword [esi + 8], 0
jne 0x5fe6a1
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x40], edi
mov dword [esi + 8], edi
test edi, edi
jne 0x5fe624
mov byte [esi], 1
jmp 0x5fe69d
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [ebp - 0x3c]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x5fe689
mov edi, dword [ebp - 0x30]
lea eax, [ebp - 0x20]
add edi, dword [ebp - 0x38]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x38]
jne 0x5fe679
nop dword [eax + eax]
add edi, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x38]
je 0x5fe660
sub edi, dword [ebp - 0x40]
je 0x5fe689
mov eax, dword [esi + 8]
dec eax
add eax, edi
mov dword [esi + 0xc], eax
jmp 0x5fe69c
push dword [esi + 8]
mov byte [esi], 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 8], 0
pop ebx
cmp dword [esi + 8], 0
mov ecx, dword [ebp - 4]
setne al
pop edi
xor ecx, ebp
pop esi
call fcn.005ce525
mov esp, ebp
pop ebp
ret
Function at 0x5ff150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x144]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x5ff1bf
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x136
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x5ff1e3
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 0
push 0
push edi
mov ecx, esi
call dword [0x64689c]
call esi
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x13c]
mov ecx, esi
push eax
push 0
push edi
call dword [0x64689c]
call esi
add esp, 0x10
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ce525
mov esp, ebp
pop ebp
ret

Function at 0x5ff540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64318c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x6ccc30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x6ceefc]
test eax, eax
jne 0x5ff66a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x5ff650
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
lfence
push 0x68e5f0
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005db7ed
mov edi, eax
add esp, 8
test edi, edi
je 0x5ff650
lea ecx, [esi*2 + 2]
push ecx
push 0
push edi
lfence
call fcn.0061e8c0
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x5ff647
cmp eax, esi
ja 0x5ff647
push edi
lea ecx, [ebp - 0x28]
lfence
call fcn.005d49c0
mov ecx, dword [0x6ceefc]
mov dword [ebp - 4], 0
test ecx, ecx
jne 0x5ff627
push 0x18
call fcn.005d0220
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x5ff61e
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.005d2ed0
mov dword [0x6ceefc], eax
jmp 0x5ff63f
xor eax, eax
mov dword [0x6ceefc], eax
jmp 0x5ff63f
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x5ff63f
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005d2810
lea ecx, [ebp - 0x28]
call fcn.005d4a10
push edi
call fcn.005db8b4
add esp, 4
mov eax, dword [0x6ceefc]
test eax, eax
jne 0x5ff66a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x5ff672
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5ffd40
Capabilities:
Check if file exists
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6432a5
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
call fcn.005e8e40
add esp, 0x10
cmp dword [ebp - 0x14], 0x16
mov dword [ebp - 4], 0
jg 0x5ffdb1
jne 0x5fff33
cmp dword [ebp - 0x18], 3
jl 0x5fff33
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5fff33
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x5fff33
push 6
xor eax, eax
mov dword [ebp - 0x3c], 0
push str._pass
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
call fcn.005d2810
mov ecx, esi
mov byte [ebp - 4], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5ffe11
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.005d7ff0
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x4c]
cmp ecx, 8
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
cmovae eax, edx
movlpd qword [ebp - 0x6c], xmm0
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x8c], 0x3c
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x5fff1d
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x74], 0
push eax
mov dword [ebp - 0x70], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
test eax, eax
je 0x5fff02
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0
push eax
push 0x20006
push 0
push 0x6550a0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5fff02
push 4
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 1
push eax
push 4
push 0
push str.bWasUserPassThroughed
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x5fff35
inc eax
lea ecx, [ebp - 0x4c]
push eax
push dword [ebp - 0x4c]
call fcn.005d31d0
jmp 0x5fff35
mov byte [ebp - 4], 3
cmp ecx, 8
jb 0x5fff33
lea eax, [ecx + 1]
push eax
push edx
lea ecx, [ebp - 0x4c]
call fcn.005d31d0
xor bl, bl
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 4
cmp ecx, 8
jb 0x5fff51
inc ecx
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.005d31d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret
Function at 0x6049b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x6d0844], 0
jne 0x604a2d
push 0x104
push 0
push 0x6d0740
call fcn.0061e8c0
add esp, 0xc
mov eax, 1
mov word [0x6d0844], ax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x604a2d
push 0x6c8c10
push 0x6d0740
lea ecx, [ebp - 8]
push ecx
push 0
push str.tOutputDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x6d0740], 0
je 0x604a49
push dword [0x6c8c10]
push 0x6d0740
call fcn.00605e40
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret

Function at 0x604a60
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
call fcn.00605e10
mov ecx, esi
pop esi
jmp fcn.00605ea0
Function at 0x637b40
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063797b

Function at 0x63a411
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063a08e

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219