joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52a710
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe04
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x1fc]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x52a74c
sub eax, 0x40
je 0x52a755
sub eax, 0x40
je 0x52a75e
jmp 0x52a767
mov dword [ebp - 0x18], 4
jmp 0x52a773
mov dword [ebp - 0x18], 6
jmp 0x52a773
mov dword [ebp - 0x18], 8
jmp 0x52a773
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x52a861
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00529df0
sub eax, 0x80
je 0x52a79a
sub eax, 0x40
je 0x52a7a3
sub eax, 0x40
je 0x52a7ac
jmp 0x52a7b5
mov dword [ebp - 0x1c], 0xa
jmp 0x52a7c1
mov dword [ebp - 0x1c], 0xc
jmp 0x52a7c1
mov dword [ebp - 0x1c], 0xe
jmp 0x52a7c1
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x52a861
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.00529e6c
mov cl, byte [ebp - 0x18]
mov edx, 0x59e12c
mov eax, dword [ebp - 4]
call fcn.00529f80
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.00529ec8
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 1
jl 0x52a84b
mov dword [ebp - 0x14], eax
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.00529e6c
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0052a0fc
mov cl, byte [ebp - 0x18]
mov edx, 0x59e12c
mov eax, dword [ebp - 4]
call fcn.00529f80
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.00529ec8
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jne 0x52a802
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.00529e6c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x52ab78
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004063e8
xor eax, eax
push ebp
push 0x52abea
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00406258
push eax
push 0
call sub.netapi32.dll_NetUserGetLocalGroups
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x52abd4
mov eax, dword [ebp - 0xc]
push eax
call sub.netapi32.dll_NetApiBufferFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52abf1
lea eax, [ebp - 4]
call fcn.004060f8
ret
Function at 0x52e698
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
xor edx, edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52e721
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x52e6fb
lea eax, [ebp - 0x8c]
lea edx, [ebp - 0x88]
mov ecx, 0x80
call fcn.00405b34
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 4]
call fcn.0040a3c4
jmp 0x52e708
mov eax, dword [ebp - 4]
mov edx, 0x52e734
call fcn.00405908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e728
lea eax, [ebp - 0x8c]
call fcn.004058b4
ret

Function at 0x52e73c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x52e7e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.0040b268
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x52e7bd
lea eax, [ebp - 0x14]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405de8
mov eax, dword [ebp - 0x14]
mov edx, 0x52e7f8
call fcn.00405cd4
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x52e7bd
mov eax, dword [ebp - 8]
call fcn.00405d88
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e7e7
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004058d8
lea eax, [ebp - 8]
call fcn.004058b4
ret

Function at 0x52e848
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, 0x104
call fcn.0040b7a4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x52e8be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x104
call fcn.00403b0c
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x52e8a0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00405abc
jmp 0x52e8a8
mov eax, dword [ebp - 8]
call fcn.004058b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e8c5
mov eax, dword [ebp - 0xc]
call fcn.0040b7f0
ret
Function at 0x52e998
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d78
xor eax, eax
push ebp
push 0x52ea51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x52ea64
call fcn.00405908
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405d88
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x52ea2e
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 0x14]
mov edx, 4
call fcn.0040a95c
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00408a34
movzx eax, ax
lea ecx, [ebp - 0x1c]
mov edx, 4
call fcn.0040a95c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00405bd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ea58
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004058d8
lea eax, [ebp - 4]
call fcn.004058b4
ret

Function at 0x52f558
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], 7
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret

Function at 0x52f580
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
call fcn.0052f558
test al, al
je 0x52f5c3
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00405d88
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x54e4f8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.00405d78
xor eax, eax
push ebp
push 0x54e6d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405d88
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x5a3004]
movzx eax, word [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [0x5a2f34]
movzx eax, word [eax]
test eax, eax
jle 0x54e690
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 1
mov eax, dword [0x5a27d0]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x14]
dec edx
mov eax, dword [0x5a2e38]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
mov ecx, dword [eax]
call dword [ecx + 0xe0]
call fcn.00586c80
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x294]
dec eax
test eax, eax
jl 0x54e680
inc eax
mov dword [ebp - 0x20], eax
xor edi, edi
lea eax, [ebp - 8]
call fcn.004058b4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x370]
mov esi, dword [eax + 0x264]
dec esi
test esi, esi
jl 0x54e669
inc esi
xor ebx, ebx
test ebx, ebx
jle 0x54e5fa
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x370]
mov ecx, edi
mov edx, ebx
call fcn.004e2b80
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x5a316c]
movzx ecx, byte [ecx]
mov dl, 0x2e
call fcn.00512e7c
jmp 0x54e610
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x370]
mov ecx, edi
mov edx, ebx
call fcn.004e2b80
test edi, edi
jne 0x54e644
test ebx, ebx
jne 0x54e644
push dword [ebp - 8]
push 0x54e6ec
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx]
call fcn.00405b28
push dword [ebp - 0x2c]
push 0x54e700
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c48
jmp 0x54e661
push dword [ebp - 8]
push 0x54e70c
push dword [ebp - 0xc]
push 0x54e700
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c48
inc ebx
dec esi
jne 0x54e5c5
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00539334
inc edi
dec dword [ebp - 0x20]
jne 0x54e5a2
inc dword [ebp - 0x14]
add dword [ebp - 0x24], 4
dec dword [ebp - 0x1c]
jne 0x54e566
mov edx, dword [ebp - 0x18]
dec edx
mov eax, dword [0x5a2e38]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
mov ecx, dword [eax]
call dword [ecx + 0xe0]
call fcn.00586c80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e6dd
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004058d8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058d8
ret
Function at 0x56bbc4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405d78
xor eax, eax
push ebp
push 0x56bd52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405d88
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [esi + 0x654]
mov eax, dword [eax + 0x264]
dec eax
test eax, eax
jl 0x56bc49
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
push dword [ebp - 8]
push 0x56bd68
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
mov edx, ebx
mov eax, dword [esi + 0x654]
call fcn.004e2b80
push dword [ebp - 0x18]
push 0x56bd74
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c48
inc ebx
dec dword [ebp - 0x14]
jne 0x56bc13
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00539334
mov eax, dword [0x5a2f34]
movzx eax, word [eax]
test eax, eax
jle 0x56bd20
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 8]
call fcn.004058b4
mov eax, dword [esi + 0x654]
mov edi, dword [eax + 0x264]
dec edi
test edi, edi
jl 0x56bd07
inc edi
xor ebx, ebx
test ebx, ebx
jle 0x56bcd2
mov eax, dword [esi + 0x654]
mov eax, dword [eax + 0x264]
sub eax, 2
cmp ebx, eax
jge 0x56bcd2
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [esi + 0x654]
call fcn.004e2b80
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0x5a316c]
movzx ecx, byte [ecx]
mov dl, 0x2e
call fcn.00512e7c
jmp 0x56bce6
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [esi + 0x654]
call fcn.004e2b80
push dword [ebp - 8]
push 0x56bd68
push dword [ebp - 0xc]
push 0x56bd74
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405c48
inc ebx
dec edi
jne 0x56bc8c
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00539334
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x56bc70
mov eax, 0x56bd80
call fcn.0044b124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56bd59
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004058d8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058d8
ret

Function at 0x56fc84
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov byte [0x5a89b0], 0
mov eax, sub.wsock32.dll_WSAStartup
test eax, eax
je 0x56fcbb
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
sub eax, 0x2726
je 0x56fcbb
add eax, 0xffffffbb
sub eax, 2
jb 0x56fcbb
mov byte [0x5a89b0], 1
add esp, 0x190
ret
Function at 0x27538b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x27538b4d
pop edi
pop ebx
pop ebp
ret 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x27538b84
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x27538b80
lea ecx, [ecx]
cmp esi, eax
jae 0x27538b84
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x27538b70
cmp esi, eax
jb 0x27538b8d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x27539390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x27539402
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x275393d1
cmp eax, 2
jne 0x275393ec
test esi, esi
mov eax, dword [ebp + 0x10]
je 0x275393fc
test eax, eax
je 0x275393f7
test al, 1
jne 0x275393ec
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x275393fc
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x275394f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x275396f1
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x275396f1
cmp dword [ebp + 0x14], 0
je 0x275396f1
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push eax
push ebx
call fcn.27539450
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], eax
jge 0x27539538
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x55555556
imul ebx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx*4]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x13
mov dword [ebp + 8], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], 0
js 0x2753965a
mov edx, dword [ebp + 0x18]
and edx, 2
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], ebx
jne 0x275395a5
mov edx, ebx
imul edx, edx, 0x4c
lea eax, [ecx*4]
sub eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 4], eax
test eax, eax
jle 0x27539617
mov edx, eax
jmp 0x275395b0
movzx eax, byte [edi + 2]
xor ecx, ecx
mov ch, byte [edi]
add edi, 3
add esi, 4
mov cl, byte [edi - 2]
shl ecx, 8
or ecx, eax
shl ecx, 8
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + 0x27502d78]
mov byte [esi - 4], al
shl ecx, 6
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + 0x27502d78]
shl ecx, 6
mov byte [esi - 3], al
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + 0x27502d78]
shr ecx, 0x14
and ecx, 0x3f
sub edx, 1
mov byte [esi - 2], al
movzx ecx, byte [ecx + 0x27502d78]
mov byte [esi - 1], cl
jne 0x275395b0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], 0
mov edx, dword [ebp + 8]
lea edx, [edx + eax*4]
mov dword [ebp + 8], edx
jne 0x27539636
mov byte [esi], 0xd
add esi, 1
mov byte [esi], 0xa
add esi, 1
add dword [ebp + 8], 2
mov edx, dword [ebp + 0x10]
add edx, 1
cmp edx, ebx
mov dword [ebp + 0x10], edx
jle 0x27539586
cmp dword [ebp + 8], 0
je 0x2753965a
cmp dword [ebp - 8], 0
jne 0x2753965a
sub esi, 2
sub dword [ebp + 8], 2
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
je 0x275396db
lea edx, [ecx + 1]
test edx, edx
je 0x275396db
xor eax, eax
test ecx, ecx
jle 0x27539677
movzx eax, byte [edi]
add edi, 1
shl eax, 8
cmp ecx, 1
jle 0x27539687
movzx ebx, byte [edi]
or eax, ebx
add edi, 1
shl eax, 8
cmp ecx, 2
jle 0x27539694
movzx ecx, byte [edi]
or eax, ecx
shl eax, 8
test edx, edx
jle 0x275396b8
mov ecx, edx
lea ecx, [ecx]
mov edi, eax
shr edi, 0x1a
mov bl, byte [edi + 0x27502d78]
mov byte [esi], bl
add esi, 1
shl eax, 6
sub ecx, 1
jne 0x275396a0
add dword [ebp + 8], edx
test byte [ebp + 0x18], 1
jne 0x275396db
mov edi, 4
sub edi, edx
test edi, edi
jle 0x275396d8
push edi
push 0x3d
push esi
call fcn.2757fdd0
add esp, 0xc
add dword [ebp + 8], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
pop ebx
pop edi
mov dword [edx], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x14
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x2753af90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x275ba2ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
push 0x27503930
push 0x275038f8
lea eax, [ebp - 0x114]
push eax
push 0x27503898
lea ecx, [ebp - 0x110]
xor ebx, ebx
push 2
push ecx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x118], ebx
call fcn.2753a320
add esp, 0x20
test esi, esi
je 0x2753b11f
cmp word [esi], bx
je 0x2753b11f
push 0x20006
push 0x27503830
push SysReAllocString
lea ecx, [ebp - 0x118]
call fcn.27539340
cmp eax, 2
jne 0x2753b063
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x11c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x27503830
push SysReAllocString
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2753b063
mov ecx, dword [ebp - 0x118]
test ecx, ecx
je 0x2753b055
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x11c]
mov dword [ebp - 0x118], ebx
jmp 0x2753b069
mov ebx, dword [ebp - 0x118]
test eax, eax
je 0x2753b0ae
jle 0x2753b079
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x114], eax
call fcn.27595010
test al, al
je 0x2753b129
mov ecx, dword [ebp - 0x114]
push ecx
push 0x27503830
push 0x275037c0
push 0x27503760
push 0
call fcn.27595fd0
add esp, 0x14
jmp 0x2753b129
test edi, edi
je 0x2753b0c9
cmp word [edi], 0
je 0x2753b0c9
push 1
push edi
push esi
lea ecx, [ebp - 0x118]
call fcn.27539410
jmp 0x2753b0d1
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x2753b129
jle 0x2753b0e1
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x114], eax
call fcn.27595010
test al, al
je 0x2753b129
test edi, edi
mov eax, edi
jne 0x2753b0fb
mov eax, 0x27503750
mov edx, dword [ebp - 0x114]
push edx
push 0x27503830
push eax
push esi
push 0x275036d8
push 0x27503678
push 0
call fcn.27595fd0
add esp, 0x1c
jmp 0x2753b129
mov dword [ebp - 0x114], 0x80070057
mov esi, dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
call fcn.2753a430
test ebx, ebx
je 0x2753b145
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2757f388
mov esp, ebp
pop ebp
ret 8
Function at 0x27547080
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x275bb950], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x275470a8
mov ecx, dword [0x275bb94c]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, 1
pop ebp
ret 0xc
cmp eax, 1
jne 0x275470c3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x275bb94c], eax
jne 0x27547104
xor eax, eax
pop ebp
ret 0xc
cmp eax, 2
jne 0x275470df
mov edx, dword [0x275bb94c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x2754710d
pop ebp
ret 0xc
cmp eax, 3
jne 0x2754710d
mov eax, dword [0x275bb94c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x2754710d
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, 1
pop ebp
ret 0xc
cmp byte [0x275bb844], 0
jne 0x275470bd
mov eax, 1
pop ebp
ret 0xc

Function at 0x27548810
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x275ba2ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea edx, [ebp - 0x210]
push edx
push 0x2001f
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
push 0
push ecx
push eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x208]
mov esi, eax
test esi, esi
jne 0x2754888b
test ecx, ecx
je 0x27548879
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [ebp - 0x210]
mov esi, eax
mov dword [ebp - 0x208], ecx
je 0x27548899
test ecx, ecx
je 0x27548960
push ecx
jmp 0x2754895a
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x204]
push eax
push 0
push ecx
mov dword [ebp - 0x20c], 0x100
call esi
test eax, eax
jne 0x27548922
lea ecx, [ecx]
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x208]
call fcn.27548810
mov edi, eax
test edi, edi
jne 0x27548974
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x208]
push eax
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x204]
push ecx
push edi
push edx
mov dword [ebp - 0x20c], 0x100
call esi
test eax, eax
je 0x275488d0
mov edi, dword [ebp - 0x214]
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x2754893d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x218]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x27548960
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2757f388
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x27548985
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.2757f388
mov esp, ebp
pop ebp
ret 4
Function at 0x27549470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275a6ab0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x275bc8c4]
mov edx, dword [eax + 0xc]
mov ecx, 0x275bc8c4
xor ebx, ebx
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ecx, dword [edi + 0x30]
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x275494f6
lea eax, [ebp - 0x14]
push eax
call fcn.2753d010
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.2753d5b0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x275494f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], ebx
mov edi, dword [ebp + 8]
jne 0x27549505
mov ebx, 0x8004886c
jmp 0x2754950c
push edi
push esi
call fcn.275545a0
call fcn.27595010
test al, al
je 0x2754952c
mov ecx, dword [edi]
push ecx
push 0x2750bbfc
push 0x2750bb90
push 3
call fcn.27595fd0
add esp, 0x10
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x2754954f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4