joyce8/EMBER2024-capa huggingface dataset:
Function at 0x598ca0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x49bc]
test eax, eax
jle 0x598d38
mov ecx, dword [esi + 0xb0]
mov edx, dword [ecx + 0x24]
mov ecx, dword [esi + 0x3214]
cmp edx, 5
jne 0x598cdb
sub eax, ecx
lea edx, [ecx + esi + 0x49c0]
push eax
push edx
mov ecx, esi
call fcn.00597050
jmp 0x598cf4
sub eax, ecx
push 0
push eax
lea eax, [ecx + esi + 0x49c0]
mov ecx, dword [esi + 0x31d8]
push eax
push ecx
call sub.WS2_32.dll_recv
mov edi, eax
push 0x6dec60
push edi
mov ecx, esi
call fcn.00547580
mov ecx, eax
test ecx, ecx
je 0x598d1a
sub eax, 0x2733
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
ret 4
mov edx, dword [esi + 0x3214]
mov ecx, dword [esi + 0x49bc]
add edx, edi
mov eax, edx
mov dword [esi + 0x3214], edx
cmp eax, ecx
jne 0x598ea7
mov ecx, esi
call fcn.00549570
mov eax, dword [esi + 0x49bc]
mov edi, dword [esp + 0x10]
xor bl, bl
cmp eax, 3
jl 0x598e18
lea edx, [esi + 0x49c0]
push edx
call fcn.00597b60
mov dword [edi + 8], eax
mov eax, dword [esi + 0x49bc]
add esp, 4
cmp eax, 6
jl 0x598da3
lea eax, [esi + 0x49c3]
push eax
call fcn.00597b60
add esp, 4
mov ecx, edi
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
call fcn.0059da30
cmp dword [esi + 0x49bc], 6
jle 0x598da3
mov cl, byte [esi + 0x49c6]
mov byte [edi + 5], cl
cmp dword [esi + 0x49bc], 0xb
jne 0x598dbe
lea edx, [esi + 0x49c7]
push edx
call fcn.0053c790
add esp, 4
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0xffffff
jne 0x598e18
mov eax, dword [esi + 0xb0]
cmp dword [eax + 0x24], 5
jne 0x598de3
lea ecx, [esp + 0x10]
push 4
push ecx
mov ecx, esi
call fcn.00597050
jmp 0x598df8
mov eax, dword [esi + 0x31d8]
push 0
lea edx, [esp + 0x14]
push 4
push edx
push eax
call sub.WS2_32.dll_recv
cmp eax, 4
je 0x598e06
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 4
lea ecx, [esp + 0x10]
push ecx
call fcn.00597b90
add esp, 4
mov dword [edi + 0x14], eax
mov bl, 1
xor eax, eax
xor cl, cl
mov al, byte [edi + 5]
add eax, 0xfffffff8
cmp eax, 0xe
ja case.0x598e2f.9
xor edx, edx
mov dl, byte [eax + 0x598eb8]
jmp dword [edx*4 + 0x598eb0]
mov cl, 1
test bl, bl
jne 0x598e42
mov eax, dword [edi + 8]
mov dword [edi + 0x14], eax
mov al, byte [edi + 0x10]
test al, al
jne 0x598e5d
xor edx, edx
mov dl, byte [edi + 6]
mov eax, dword [esi + edx*4 + 0x4898]
mov edx, dword [edi + 0x14]
add edx, eax
mov dword [edi + 0x14], edx
test cl, cl
je 0x598e84
mov ecx, esi
mov dword [esi + 0x8c], 0x18
call fcn.005967b0
test eax, eax
jne 0x598ea7
push edi
mov ecx, esi
call fcn.00598ed0
pop edi
pop esi
pop ebx
ret 4
mov ecx, esi
mov dword [esi + 0x8c], 0x17
call fcn.005967b0
test eax, eax
jne 0x598ea7
push edi
mov ecx, esi
call fcn.0059b2b0
pop edi
pop esi
pop ebx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
Function at 0x59b2b0
Capabilities:
Enumerate pe sections
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
mov eax, dword [esi + 0x18]
mov edi, ecx
cmp eax, ebx
jbe 0x59b2ec
cmp dword [esi + 0x20], ebx
jne 0x59b2ec
push eax
mov ecx, esi
call fcn.0059d970
test al, al
jne 0x59b2ec
push 0x6deee0
mov ecx, edi
call fcn.005474d0
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret 4
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov ebp, dword [edi + 0x346c]
sub eax, edx
cmp ebp, ebx
jne 0x59b304
mov ebp, dword [edi + 0x3468]
cmp eax, ebp
jge 0x59b30a
mov ebp, eax
test ebp, ebp
mov dword [edi + 0x346c], ebx
je 0x59b372
mov eax, dword [edi + 0xb0]
cmp dword [eax + 0x24], 5
jne 0x59b333
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
add ecx, edx
push ebp
push ecx
mov ecx, edi
call fcn.00597050
jmp 0x59b34b
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
push 0
add edx, eax
mov eax, dword [edi + 0x31d8]
push ebp
push edx
push eax
call sub.WS2_32.dll_recv
mov ebx, eax
push 0x6dec60
push ebx
mov ecx, edi
call fcn.00547580
mov ecx, eax
test ecx, ecx
je 0x59b372
sub eax, 0x2733
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
and eax, ecx
pop ebx
ret 4
mov ecx, dword [esi + 0x1c]
add ecx, ebx
cmp ebx, ebp
mov dword [esi + 0x1c], ecx
je 0x59b38f
sub ebp, ebx
xor eax, eax
mov dword [edi + 0x346c], ebp
pop edi
pop esi
pop ebp
pop ebx
ret 4
xor eax, eax
mov dl, byte [esi + 4]
mov al, byte [esi + 6]
lea ecx, [eax + eax*4]
lea eax, [edi + ecx*8 + 0x3498]
mov byte [eax + 4], dl
mov cl, byte [esi + 5]
mov byte [eax + 5], cl
mov dl, byte [esi + 6]
mov byte [eax + 6], dl
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov cl, byte [esi + 0x10]
mov byte [eax + 0x10], cl
mov edx, dword [esi + 0x14]
mov dword [eax + 0x14], edx
mov ecx, dword [esi + 0x18]
mov dword [eax + 0x18], ecx
mov edx, dword [esi + 0x1c]
mov dword [eax + 0x1c], edx
mov ecx, dword [esi + 0x20]
mov dword [eax + 0x20], ecx
mov dl, byte [esi + 0x24]
mov byte [eax + 0x24], dl
mov ecx, edi
mov dword [edi + 0x8c], 0x15
mov dword [edi + 0x346c], 0
call fcn.00549570
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
cmp eax, ecx
jne 0x59b472
mov cl, byte [esi + 0x10]
mov eax, dword [esi + 8]
test cl, cl
mov dword [esi + 0x14], eax
jne 0x59b423
xor ecx, ecx
mov cl, byte [esi + 6]
mov edx, dword [edi + ecx*4 + 0x4898]
add edx, eax
mov dword [esi + 0x14], edx
mov ecx, dword [esi + 0x14]
xor eax, eax
mov al, byte [esi + 6]
push esi
mov dword [edi + eax*4 + 0x4898], ecx
xor eax, eax
mov al, byte [esi + 6]
xor ecx, ecx
lea edx, [eax + eax*4]
xor eax, eax
mov dword [edi + edx*8 + 0x34b8], ecx
mov al, byte [esi + 6]
lea eax, [eax + eax*4]
mov dword [edi + eax*8 + 0x34b4], ecx
xor eax, eax
mov al, byte [esi + 6]
add eax, 0x151
lea ecx, [eax + eax*4]
mov byte [edi + ecx*8], 0
mov ecx, edi
call fcn.0059b740
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.0059da10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x59cab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x625ca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.0053bd30
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push 0
push eax
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0
call fcn.0053c180
test eax, eax
jge 0x59cb07
push 0x6df2a8
mov ecx, esi
call fcn.005474d0
jmp 0x59cc81
push 0
lea ecx, [esp + 0x10]
call fcn.0053c2e0
mov ecx, eax
call fcn.0053b680
push eax
lea ecx, [esp + 0xc]
call fcn.005fa8c7
mov edx, dword [esp + 8]
push 0x6dd564
push edx
mov byte [esp + 0x30], 1
call fcn.005df8da
add esp, 8
test eax, eax
jne 0x59cc73
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c4154
call fcn.005fa8c7
lea ecx, [esp + 0x14]
push ecx
call fcn.0059c9c0
add esp, 0xc
test al, al
je 0x59cc73
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x59cbf6
mov edi, dword [esi + 0xb0]
fld qword [edi + 0x358]
fcomp qword [0x633be8]
fnstsw ax
test ah, 0x41
jne 0x59cbf6
mov ecx, dword [esp + 0x30]
call fcn.0053b650
fcomp qword [edi + 0x358]
fnstsw ax
test ah, 0x40
jne 0x59cc64
mov edx, dword [0x6e7b6c]
mov dword [esp + 0x34], edx
mov eax, dword [esi + 0xb0]
mov byte [esp + 0x28], 2
mov ecx, dword [eax + 0x35c]
push ecx
mov edx, dword [eax + 0x358]
lea eax, [esp + 0x38]
push edx
push 0x6df280
push eax
call fcn.005f368b
mov ecx, dword [esp + 0x44]
add esp, 0x10
push ecx
mov ecx, esi
call fcn.005474d0
mov byte [esp + 0x28], 1
lea ecx, [esp + 0x34]
jmp 0x59cc5f
mov ecx, dword [esp + 0x30]
call fcn.0053b650
mov edx, dword [esi + 0xb0]
fstp qword [edx + 0x358]
mov ecx, dword [esi + 0x31dc]
call fcn.005a0350
mov eax, dword [0x6e7b6c]
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0xb0]
mov byte [esp + 0x28], 3
mov edx, dword [ecx + 0x35c]
push edx
mov eax, dword [ecx + 0x358]
lea ecx, [esp + 0x38]
push eax
push 0x6df270
push ecx
call fcn.005f368b
mov edx, dword [esp + 0x44]
add esp, 0x10
mov ecx, esi
push edx
call fcn.005474d0
mov byte [esp + 0x28], 1
lea ecx, [esp + 0x34]
call fcn.005fa859
mov eax, dword [0x6ed964]
push 1
push eax
mov ecx, esi
call fcn.00547400
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.005fa859
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0053bda0
mov ecx, dword [esp + 0x20]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret 8
Function at 0x59f0f0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
mov esi, ecx
push eax
lea ecx, [esp + 8]
push 0x6c3570
push ecx
call fcn.005deb38
mov edx, dword [esp + 0x20]
mov ecx, dword [esi + 0x104]
add esp, 0xc
lea eax, [esp + 4]
push 0x10
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
add esp, 8
ret 8

Function at 0x59f140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push esi
mov esi, ecx
push eax
lea ecx, [esp + 8]
push 0x6c3570
push ecx
call fcn.005deb38
mov eax, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x10]
lea ecx, [esp + 4]
push edx
mov edx, dword [esi + 0x104]
push eax
push 0
push 0
push ecx
push edx
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
pop esi
inc eax
add esp, 8
ret 8

Function at 0x59f1a0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x625e10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x28]
call fcn.0053c970
mov ecx, dword [0x6e7b6c]
xor eax, eax
mov dword [esp + 0x220], eax
mov dword [esi + 0x130], ecx
mov edx, dword [0x6e7b6c]
mov dword [esi + 0x184], edx
mov dword [esi], 0x656de4
mov ecx, 1
mov dword [esi + 0x194], 0x20
mov dword [esi + 0x198], ecx
mov dword [esi + 0x190], eax
mov dword [esi + 0x170], eax
mov edx, dword [0x6ec288]
mov byte [esp + 0x220], 2
mov dword [esi + 0x168], edx
mov edx, dword [0x6ec28c]
mov dword [esi + 0x16c], edx
mov dword [esi + 0x1a8], eax
mov dword [esi + 0x1b0], eax
mov dword [esi + 0x188], eax
mov dword [esi + 0x208], eax
mov dword [esi + 0x1e0], eax
mov dword [esi + 0x218], eax
mov dword [esi + 0x1f0], eax
mov dword [esi + 0x174], eax
mov dword [esi + 0x178], eax
mov dword [esi + 0x1ac], eax
mov dword [esi + 0x1b8], eax
mov dword [esi + 0x1b4], eax
mov dword [esi + 0x18c], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x224], eax
mov dword [esi + 0x22c], eax
mov dword [esi + 0x134], eax
mov dword [esi + 0x204], eax
mov dword [esi + 0x20c], eax
mov dword [esi + 0x1e4], eax
mov dword [esi + 0x210], eax
mov dword [esi + 0x21c], eax
mov dword [esi + 0x220], eax
mov dword [esi + 0x1c0], eax
mov dword [esi + 0x1f4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x138], eax
mov dword [esi + 0x13c], eax
mov dword [esi + 0x140], eax
mov dword [esi + 0x144], eax
mov dword [esi + 0x150], eax
mov dword [esi + 0x154], eax
mov dword [esi + 0x158], eax
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
mov dword [esi + 0x160], eax
lea eax, [esp + 0x88]
mov dword [esi + 0x148], ecx
push eax
push 0x202
mov dword [esi + 0x15c], 0xffffffff
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x59f34f
push 2
push 2
lea ecx, [esp + 0x10]
push 0x6df460
push ecx
call fcn.005deb38
add esp, 0x10
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.0059f530
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x59f600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x22c]
test eax, eax
je 0x59f697
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push 0x6df4a8
push eax
mov dword [esp + 0x20], 4
call edi
test eax, eax
jne 0x59f697
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esi + 0x190], eax
mov eax, dword [esi + 0x22c]
push 0
push 0
push 0x6df498
push eax
mov dword [esi + 0x174], 1
mov dword [esp + 0x20], 8
call edi
test eax, eax
jne 0x59f697
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x168], ecx
mov dword [esi + 0x16c], edx
mov dword [esi + 0x170], 1
pop edi
pop esi
add esp, 0x10
ret

Function at 0x5a02a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x22c]
test eax, eax
je 0x5a0347
mov ecx, dword [esi + 0x1b0]
mov edx, dword [esi + 0x1b4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push 8
push ecx
push 0
push 0
push 0x6d105c
push eax
mov dword [esp + 0x28], edx
call edi
mov eax, dword [esi + 0x1b8]
cmp eax, 0x64
mov dword [esp + 8], eax
jle 0x5a030a
mov eax, dword [esi + 0x22c]
lea edx, [esp + 8]
push 4
push edx
push 4
push 0
push 0x6df594
push eax
call edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x24]
cmp ecx, 4
je 0x5a0324
cmp ecx, 5
je 0x5a0324
mov ecx, dword [eax + 0x2f8]
test ecx, ecx
je 0x5a0347
fld qword [esi + 0x188]
mov edx, dword [esi + 0x22c]
lea ecx, [esp + 0x14]
push 8
push ecx
push 0
push 0
push 0x6df584
push edx
fstp qword [esp + 0x2c]
call edi
pop edi
pop esi
add esp, 0x14
ret

Function at 0x5a0350
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xc]
fld qword [ecx + 0x358]
fcomp qword [0x633be8]
fnstsw ax
test ah, 0x41
jne 0x5a0439
mov eax, dword [ecx + 0x2f8]
test eax, eax
jne 0x5a0392
mov edi, dword [esi + 0x1a0]
mov ecx, esi
call fcn.0059f810
mov dword [esi + 0x198], eax
mov dword [esi + 0x1a0], edi
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [eax]
test eax, eax
je 0x5a03b0
push 0
push 0x146d
push 0x111
push eax
call edi
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
test eax, eax
je 0x5a03cd
mov edx, dword [esi + 0x228]
push edx
push 0x146d
push 0x111
push eax
call edi
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
test eax, eax
je 0x5a03e5
push 0
push 0x146d
push 0x111
push eax
call edi
mov eax, dword [esi + 0x22c]
test eax, eax
je 0x5a0439
mov ecx, dword [esi + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add ecx, 0x358
push 8
push ecx
push 0
push 0
push 0x6c3594
push eax
call edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x2f8]
test ecx, ecx
je 0x5a0439
lea eax, [esp + 8]
push 4
push eax
mov edx, ecx
mov ecx, dword [esi + 0x22c]
push 4
push 0
push 0x6c35ac
push ecx
mov dword [esp + 0x20], edx
call edi
pop edi
pop esi
pop ecx
ret
Function at 0x5a0440
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
add eax, 0xf0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
or ecx, edx
je 0x5a04cf
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [edx]
test eax, eax
je 0x5a0473
push 0
push 0x14a5
push 0x111
push eax
call edi
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x5a0490
mov ecx, dword [esi + 0x228]
push ecx
push 0x14a5
push 0x111
push eax
call edi
mov edx, dword [esi + 0x18]
mov eax, dword [edx]
test eax, eax
je 0x5a04a8
push 0
push 0x14a5
push 0x111
push eax
call edi
mov eax, dword [esi + 0x22c]
pop edi
test eax, eax
je 0x5a04cf
mov ecx, dword [esi + 0xc]
push 8
add ecx, 0xf0
push ecx
push 0
push 0
push 0x6c3584
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret

Function at 0x5a04e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x22c]
test eax, eax
je 0x5a05af
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push 0x6c3594
push eax
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5a05af
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [eax + 0x358], ecx
mov dword [eax + 0x35c], edx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x2f8]
test ecx, ecx
jne 0x5a055c
mov edi, dword [esi + 0x1a0]
mov ecx, esi
call fcn.0059f810
mov dword [esi + 0x198], eax
mov dword [esi + 0x1a0], edi
mov ecx, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ecx]
test eax, eax
je 0x5a057a
push 0
push 0x146d
push 0x111
push eax
call edi
mov edx, dword [esi + 0x14]
mov eax, dword [edx]
test eax, eax
je 0x5a0597
mov ecx, dword [esi + 0x228]
push ecx
push 0x146d
push 0x111
push eax
call edi
mov edx, dword [esi + 0x18]
mov eax, dword [edx]
test eax, eax
je 0x5a05af
push 0
push 0x146d
push 0x111
push eax
call edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x5a0b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x625ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x18]
xor ebx, ebx
push eax
push ecx
mov dword [esi + 0x1bc], ebx
mov edx, dword [0x6ec7a0]
push ebx
push ebx
push 0x6d5c8c
push edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 4
call edi
test eax, eax
jne 0x5a0b75
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x1bc], eax
jmp 0x5a0bc5
mov eax, dword [0x6ec7a0]
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push ebx
push ebx
push 0x6d5c7c
push eax
mov dword [ebp - 0x14], 4
call edi
test eax, eax
jne 0x5a0bc5
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x5a0bc5
cmp eax, 0x1f400
ja 0x5a0bb1
mov dword [esi + 0x1bc], 1
jmp 0x5a0bc5
mov ecx, 0x7d000
cmp ecx, eax
sbb edx, edx
neg edx
add edx, 2
mov dword [esi + 0x1bc], edx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 0x24]
push ecx
push edx
mov ecx, 0x6ec640
call fcn.004e9b00
push eax
mov ecx, esi
call fcn.0059f6a0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a7eb0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
push edi
xor edi, edi
cmp eax, edi
jne 0x5a7ec7
pop edi
xor eax, eax
pop esi
add esp, 8
ret
push edi
push edi
push 3
push edi
push 3
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5a7ee9
pop edi
xor eax, eax
pop esi
add esp, 8
ret
lea ecx, [esp + 0x14]
push edi
xor eax, eax
push ecx
lea edx, [esp + 0x10]
push 8
mov dword [esp + 0x14], eax
push edx
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5a7f2c
cmp dword [esp + 0x14], 8
jne 0x5a7f2c
lea ecx, [esp + 0xc]
mov eax, 0x6df930
mov edx, dword [ecx]
mov ecx, dword [eax]
cmp edx, ecx
jne 0x5a7f2c
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x5aa300
Capabilities:
Access peb ldr_data
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x6269b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x30]
lea eax, [esp + 0xc]
push edi
push eax
push esi
push 0
push 0
push ecx
push ebx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5aa371
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5aa371
push esi
call fcn.005b5ee0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x2c]
push edx
push esi
push 0
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5aa425
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5aa425
mov eax, dword [0x6e7b6c]
mov dword [esp + 0x28], eax
push esi
lea ecx, [esp + 0x2c]
push 0x6bc090
push ecx
mov dword [esp + 0x28], 0
call fcn.005f368b
mov edx, dword [esp + 0x34]
push edx
call fcn.005b5ee0
mov edx, dword [esp + 0x38]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x40]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x5aa3fc
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.005fa859
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5aa440
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push 0x6269d8
push eax
mov eax, dword [esp + 0x20]
mov dword fs:[0], esp
push esi
test eax, eax
push edi
je 0x5aa4a0
test edx, edx
je 0x5aa475
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x5aa4a0
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push eax
push esi
call edi
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [0x6e7b6c]
mov dword [esp + 0x28], eax
push edx
lea ecx, [esp + 0x2c]
push 0x6bc090
push ecx
mov dword [esp + 0x1c], 0
call fcn.005f368b
mov edx, dword [esp + 0x34]
push edx
call fcn.005b5ee0
mov edx, dword [esp + 0x38]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
mov esi, dword [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x30]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x5aa501
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], 0xffffffff
call fcn.005fa859
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret

Function at 0x5aa530
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
push ecx
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5aa579
push edi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x5aa579
push esi
call fcn.005b5ee0
add esp, 4
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x5aa580
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x6269f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6e7b6c]
push edi
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x20]
lea edx, [esp + 4]
push ecx
push 0x6bc090
push edx
mov dword [esp + 0x1c], 0
call fcn.005f368b
mov eax, dword [esp + 0x10]
push eax
call fcn.005b5ee0
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push eax
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.005fa859
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret