joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ae80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c
call fcn.00663af0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0xc]
shr ecx, 3
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], ecx
cmp esi, dword [ebp + 0xc]
jb 0x52b071
nop dword [eax]
mov dword [ebp - 8], 0
test ecx, ecx
je 0x52b058
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 7]
cdq
mov edi, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 5]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 4]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 3]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 2]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 1]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
mov dword [ebp - 4], ecx
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
mov eax, edi
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
mov eax, ebx
and ecx, 0xff00ff
and eax, 0x55555555
mov dword [ebp - 0x14], ecx
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
and edi, 0xaaaaaaaa
mov dword [ebp - 0x10], ecx
lea eax, [edi + edi]
or eax, edi
and ebx, 0xaaaaaaaa
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
lea eax, [ebx + ebx]
or eax, ebx
and ecx, 0xf0f0f0f0
and eax, 0xcccccccc
mov edi, ecx
shl edi, 4
or edi, ecx
and edi, 0xff00ff00
lea ecx, [eax*4]
mov ebx, edi
or ecx, eax
shr ebx, 8
and ecx, 0xf0f0f0f0
and edi, 0xffff00
mov edx, ecx
or ebx, edi
shl edx, 4
or edx, ecx
mov edi, dword [ebp - 0x18]
and edx, 0xff00ff00
shr ebx, 8
mov eax, edx
shl eax, 8
or eax, edx
xor edx, edx
and eax, 0xffff0000
or ebx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl eax, 8
and ecx, 0xffffff00
or ecx, eax
mov eax, dword [ebp - 0x14]
shr eax, 8
or eax, dword [ebp - 0x14]
movzx eax, ax
shl ecx, 8
or ecx, eax
mov eax, dword [ebp - 8]
or edx, ecx
xor dword [edi + eax*8], edx
xor dword [edi + eax*8 + 4], ebx
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x52aec2
mov esi, dword [ebp + 8]
mov ecx, edi
call fcn.0052ad60
sub esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], esi
cmp esi, dword [ebp + 0xc]
jae 0x52aeb0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x537fa0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00663af0
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov ecx, dword [ebp + 0xc]
push edi
xor edi, edi
call fcn.00494730
mov ecx, dword [ebp + 0xc]
call fcn.004948a0
mov esi, eax
test esi, esi
je 0x5381b6
mov edx, dword [ebx + 4]
add edx, edx
cmp edx, dword [esi + 8]
jle 0x537fea
mov ecx, esi
call fcn.0046e3f0
test eax, eax
je 0x5381b6
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x53816e
mov edi, ecx
nop word [eax + eax]
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x538000
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
mov dword [esi + 4], eax
test eax, eax
jle 0x538193
mov ecx, dword [esi]
lea ecx, [ecx + eax*4]
nop dword [eax]
cmp dword [ecx - 4], 0
lea ecx, [ecx - 4]
jne 0x53818e
dec eax
test eax, eax
jg 0x538180
mov dword [esi + 4], eax
test eax, eax
jne 0x53819c
mov dword [esi + 0xc], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005379c0
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.00494830
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x583610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.00663af0
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov eax, dword [eax + 0x64]
inc ebx
push edi
mov edi, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], edi
test byte [eax + 0x30], 1
mov esi, dword [edi + 8]
je 0x58368d
mov ecx, dword [ebp + 8]
lea eax, [ebx + ecx]
cmp eax, esi
ja 0x583691
add dword [edi + 0x14], ecx
sub esi, ecx
add dword [edi + 0x18], ecx
sub dword [edi + 0xc], ecx
mov ecx, dword [ebp - 4]
mov dword [edi + 8], esi
mov eax, dword [edi + 0x14]
dec eax
add eax, esi
mov dword [ebp - 8], eax
mov al, byte [eax]
movzx edx, al
mov byte [ebp + 0xf], al
mov eax, dword [ecx + 0x3cc]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test dword [eax + 0x10], 0x200000
je 0x58369a
sub esi, edx
mov eax, 1
dec esi
mov dword [edi + 8], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, esi
jbe 0x583656
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edx + ebx]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x58370e
mov ecx, dword [ebp - 4]
mov edx, ecx
mov esi, dword [ebp - 8]
shr edx, 0x1f
xor edi, edi
mov dword [ebp - 0x10], edx
sub ecx, edi
lea esi, [esi - 1]
shr ecx, 0x1f
mov eax, edi
shr eax, 0x1f
inc edi
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [ebp + 0xf]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
mov ecx, dword [ebp - 4]
not edx
and ebx, edx
mov edx, dword [ebp - 0x10]
cmp edi, dword [ebp - 0xc]
jb 0x5836d0
mov edi, dword [ebp - 0x14]
mov edx, ecx
mov esi, dword [edi + 8]
not ebx
lea eax, [edx + 1]
movzx ecx, bl
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edi + 8], esi
mov dword [ebp + 0xc], ecx
not ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x583740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa0
call fcn.00663af0
mov eax, dword [0x74e694]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0xa0], ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
sub ecx, edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x98], ecx
cmp edx, edi
jb 0x58392b
cmp edi, 0x40
ja 0x58392b
lea eax, [ebp - 0x84]
neg eax
lea ecx, [ebp - 0x84]
and eax, 0x3f
add ecx, eax
lea eax, [edi + 0x100]
mov dword [ebp - 0x9c], ecx
cmp edx, eax
jbe 0x5837b8
mov ebx, edx
sub ebx, edi
sub ebx, 0x100
push esi
push edi
xor esi, esi
mov dword [ebp - 0x90], 0
push esi
push ecx
call fcn.00667150
mov eax, dword [ebp - 0x8c]
add esp, 0xc
mov dword [ebp - 0x94], esi
cmp ebx, dword [eax + 0xc]
jae 0x58388f
mov ecx, ebx
sub ecx, dword [eax + 8]
mov dword [ebp - 0x88], ecx
mov edi, dword [ebp - 0x8c]
mov eax, ebx
xor eax, dword [ebp - 0x98]
lea edx, [eax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov eax, dword [ebp - 0x8c]
neg edx
xor ecx, dword [eax + 8]
mov eax, ebx
xor eax, dword [edi + 8]
or ecx, eax
mov eax, edx
or eax, dword [ebp - 0x90]
xor ecx, ebx
and edx, dword [ebp - 0x94]
shr ecx, 0x1f
or esi, edx
mov edx, dword [ebp - 0x94]
neg ecx
and ecx, eax
mov eax, dword [edi + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x90], ecx
mov al, byte [eax + ebx]
inc ebx
and al, cl
mov ecx, dword [ebp - 0x9c]
or byte [edx + ecx], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
mov eax, dword [ebp - 0x8c]
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [ebp - 0x88]
inc ecx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x88], ecx
cmp ebx, dword [eax + 0xc]
jb 0x5837f0
mov dword [ebp - 0x88], 0
test edi, edi
je 0x583915
mov ecx, dword [ebp - 0x9c]
mov eax, esi
and eax, 0xffffffdf
mov bl, byte [eax + ecx]
mov eax, esi
or eax, 0x20
mov dl, byte [eax + ecx]
mov eax, esi
and eax, 0x20
inc esi
dec eax
shr eax, 0x1f
neg al
movzx eax, al
mov dword [ebp - 0x90], eax
not eax
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x90]
and cl, dl
mov edx, dword [ebp - 0x88]
and al, bl
or al, cl
mov ecx, dword [ebp - 0xa0]
mov byte [ecx + edx], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
mov dword [ebp - 0x88], edx
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x5838a1
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00663ada
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.00663ada
mov esp, ebp
pop ebp
ret
Function at 0x5a7aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68ed99
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push edi
mov eax, dword [0x74e694]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
call fcn.005c34c0
add esp, 8
lea eax, [ebp + 8]
push 0
push eax
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
push dword [ebp - 0x18]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 8]
mov dword [ebp - 0x10], 0x1234
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5a7b30
push eax
call fcn.0066a657
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x5b6a00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x690214
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x74e694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
push 0
mov dword [ebp - 0x48], 0x104
call fcn.0066a672
mov esi, eax
add esp, 8
mov dword [ebp - 0x4c], esi
push 0
push 0x23
push esi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x5b6b73
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.005c3530
add esp, 8
push 0x26
push 0x69e4d0
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004485a0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x2c]
mov byte [ebp - 4], 3
cmp edx, 0x10
jb 0x5b6aee
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5b6ae4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5b6ba1
push edx
push ecx
call fcn.00663ac7
add esp, 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], 0
push eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.005c56c0
mov edx, dword [ebp - 0x14]
add esp, 4
test al, al
je 0x5b6b46
cmp edx, 0x10
jb 0x5b6b40
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5b6b36
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5b6ba6
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov byte [ebp - 0x41], 1
jmp 0x5b6b77
cmp edx, 0x10
jb 0x5b6b73
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5b6b69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5b6ba6
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov byte [ebp - 0x41], 0
test esi, esi
je 0x5b6b84
push esi
call fcn.0066a657
add esp, 4
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00663ada
mov esp, ebp
pop ebp
ret
call fcn.0066a5fb
call fcn.0066a5fb
int3
Function at 0x5c1270
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x5c12b2
push 2
push dword [esi + 0x12c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xb8]
mov byte [esi + 0x20], 0
test eax, eax
je 0x5c12a6
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi + 0xb8], 0
push dword [esi + 0x158]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x5c1440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [esi + 0xc8]
mov dword [eax + 0x10], 0
mov byte [esi + 0xe0], 1
mov byte [esi + 0x21], 0
mov dword [esi + 0x104], 0
cmp dword [eax + 0x14], 0x10
jb 0x5c1471
mov eax, dword [eax]
mov byte [eax], 0
lea eax, [esi + 0x24]
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 0x10
jb 0x5c1486
mov eax, dword [eax]
mov byte [eax], 0
lea ecx, [esi + 0xe4]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
je 0x5c14a9
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5c14a0
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x5c14cc
lea ecx, [esi + 0x10c]
cmp ecx, eax
je 0x5c14cc
cmp dword [eax + 0x14], 0x10
jb 0x5c14c5
mov eax, dword [eax]
push edx
push eax
call fcn.004484a0
push dword [ebp + 8]
mov ecx, esi
call fcn.005c1fb0
cmp dword [esi + 0x11c], 0
je 0x5c14ff
push edi
lea edi, [esi + 0x10c]
push edi
call fcn.005c56c0
add esp, 4
test al, al
je 0x5c14fe
push 1
push edi
call fcn.005c35d0
add esp, 8
pop edi
lea eax, [ebp - 4]
mov byte [esi + 0x20], 1
push eax
push 0
push esi
push 0x5c0a40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi + 0x150], 0
mov dword [esi + 0x12c], eax
jne 0x5c1531
cmp dword [esi + 0x154], 0
je 0x5c1538
mov ecx, esi
call fcn.005c1cf0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5c2310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x11c], 0
je 0x5c2340
push edi
lea edi, [esi + 0x10c]
push edi
call fcn.005c56c0
add esp, 4
test al, al
je 0x5c233f
push 1
push edi
call fcn.005c35d0
add esp, 8
pop edi
lea eax, [ebp - 4]
mov byte [esi + 0x20], 1
push eax
push 0
push esi
push 0x5bfd00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi + 0x150], 0
mov dword [esi + 0x12c], eax
jne 0x5c2372
cmp dword [esi + 0x154], 0
je 0x5c2379
mov ecx, esi
call fcn.005c1cf0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c4400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x691769
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x74e694]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x10]
call fcn.005c34c0
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
add esp, 8
push eax
push 0x20019
push 0
push edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5c44a3
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
test edi, edi
je 0x5c448f
push edi
call fcn.0066a657
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x14]
call fcn.005c34c0
push 0x800
push 0
mov dword [ebp - 0x24], 0x400
call fcn.0066a672
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x28], esi
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push 0
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
je 0x5c4516
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
jmp 0x5c4536
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x5c4529
cmp eax, 7
jne 0x5c44fa
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.005c3530
add esp, 8
test esi, esi
je 0x5c4543
push esi
call fcn.0066a657
add esp, 4
test ebx, ebx
je 0x5c4550
push ebx
call fcn.0066a657
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5c4570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
call fcn.005c34c0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 4]
add esp, 8
push eax
push 0x20019
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5c45f4
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
call fcn.005c34c0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
add esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x5c460b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
test esi, esi
je 0x5c4603
push esi
call fcn.0066a657
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
jmp 0x5c45f6
Function at 0x5c4620
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
call fcn.005c34c0
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5c4670
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x5c46e2
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
call fcn.005c34c0
push 0x800
push 0
call fcn.0066a672
add esp, 0x10
mov dword [ebp - 8], 0x400
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x5c46c9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x5c46d4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebx]
mov esi, dword [ebx + 4]
test ebx, ebx
je 0x5c46e1
push ebx
call fcn.0066a657
add esp, 4
pop ebx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x5c46f2
push eax
call fcn.0066a657
add esp, 4
mov eax, edi
mov edx, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5c4700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0
call fcn.005c34c0
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 8]
add esp, 8
push eax
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x5c474c
xor bl, bl
jmp 0x5c47ad
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
call fcn.005c34c0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp + 0x14]
mov dword [ebp - 0x14], 0
call fcn.005c34c0
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov edi, dword [ebp - 0x18]
add eax, eax
mov esi, dword [ebp - 0x10]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x5c47ac
push edi
call fcn.0066a657
add esp, 4
pop edi
test esi, esi
je 0x5c47ba
push esi
call fcn.0066a657
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret