joyce8/EMBER2024-capa huggingface dataset:
Function at 0x504a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5f0a4c]
and eax, 1
jne 0x504aa8
mov ecx, dword [0x5f0a4c]
or ecx, 1
mov dword [0x5f0a4c], ecx
push 0x5b21d4
mov ecx, 0x5f0a30
call fcn.00424f10
push 0x5a61a0
call fcn.0056214b
add esp, 4
push 0x5b21d8
push 0x5f0a30
call fcn.00505180
add esp, 8
movzx edx, al
test edx, edx
je 0x504ad6
push 0x5f0a30
mov ecx, dword [ebp + 8]
call fcn.0042df80
mov eax, dword [ebp + 8]
jmp 0x504be6
mov dword [ebp - 8], 1
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0xc], 4
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.0055e2a0
add esp, 0xc
mov dword [ebp - 4], 0x208
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 8]
push eax
push 0x5b21dc
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x504bd6
push 0x208
push 0
lea ecx, [ebp - 0x428]
push ecx
call fcn.0055e2a0
add esp, 0xc
mov dword [ebp - 0x220], 0x208
mov dword [ebp - 8], 1
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x5b21e8
push str.Software360360se6UpdateClientState02E720BD_2B50_4404_947C_65DBE64F6970
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x504bd6
push 0x208
push 0
lea edx, [ebp - 0x630]
push edx
call fcn.0055e2a0
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.......
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x630]
push eax
mov ecx, 0x5f0a30
call fcn.004464f0
push 0x5f0a30
mov ecx, dword [ebp + 8]
call fcn.0042df80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x528ed0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x420], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x528f0b
xor eax, eax
jmp 0x529086
push 0x104
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x528f2f
xor eax, eax
jmp 0x529086
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x528f4c
xor eax, eax
jmp 0x529086
xor eax, eax
mov ecx, dword [ebp - 4]
mov word [ecx], ax
push str...360verify.dll
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x528f86
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x529020
xor edx, edx
mov word [ebp - 0x638], dx
push 0x206
push 0
lea eax, [ebp - 0x636]
push eax
call fcn.0055e2a0
add esp, 0xc
mov dword [ebp - 0x42c], 0x208
mov dword [ebp - 0x428], 1
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x638]
push edx
lea eax, [ebp - 0x428]
push eax
push 0x5b2b4c
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
movzx ecx, word [ebp - 0x638]
test ecx, ecx
je 0x52901c
push str.360verify.dll
lea edx, [ebp - 0x638]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x52901c
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x529020
xor eax, eax
jmp 0x529086
lea edx, [ebp - 0x210]
push edx
call fcn.004be3a0
add esp, 4
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x529080
push str.GetCIDW
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0
je 0x529073
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x63c]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x52a080
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5f0b0c], 0
jne 0x52a135
mov dword [ebp - 0x80c], 0x400
push 0x400
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [0x5f0b08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [ebp - 0x810], 0
jmp 0x52a0eb
mov eax, dword [ebp - 0x810]
add eax, 1
mov dword [ebp - 0x810], eax
mov ecx, dword [ebp - 0x810]
cmp ecx, dword [0x5f0b04]
jge 0x52a108
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x52a0dc
push str.360Common.dll
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp - 0x808]
push edx
call fcn.004c4900
add esp, 4
mov dword [0x5f0b0c], eax
cmp dword [0x5f0b0c], 0
jne 0x52a142
xor eax, eax
jmp 0x52a1b8
push str.Get360CommonInstance
mov eax, dword [0x5f0b0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f0b10], eax
push str.Get360ProductHistoryManager
mov ecx, dword [0x5f0b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f0b14], eax
push str.Create360FireWareStateFunction
mov edx, dword [0x5f0b0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f0b18], eax
push str.GetFireWallState
mov eax, dword [0x5f0b0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f0b1c], eax
push str.Create360FireWareStateFunction2
mov ecx, dword [0x5f0b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f0b20], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret

Function at 0x52c350
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x52c3c9
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x14]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [ebp + 8]
neg edx
sbb edx, edx
and edx, 2
mov dword [ebp - 0xc], edx
push 0
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x52c3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x14]
call fcn.0052cbe0
mov dword [ebp - 4], eax
push 1
call fcn.0052c350
add esp, 4
mov dword [ebp - 0xc], 0
jmp 0x52c407
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jge 0x52c4ae
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0052cc00
cmp dword [eax], 0
jne 0x52c426
jmp 0x52c3fe
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0052cc00
mov ecx, dword [eax]
cmp dword [ecx + 4], 0
jne 0x52c4a9
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0052cc00
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x52c476
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0052cc00
mov eax, dword [eax]
mov dword [eax + 4], 2
push 1
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0052cc00
mov edx, dword [eax]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x54]
call fcn.005006f0
jmp 0x52c3fe
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x532f40
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [0x5f1948], 0
jne 0x53302f
push str.WINTRUST.DLL
call fcn.004b8690
add esp, 4
mov dword [ebp - 4], eax
push str.CryptCATAdminAcquireContext
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f1930], eax
push str.CryptCATAdminReleaseContext
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f1934], eax
push str.CryptCATAdminCalcHashFromFileHandle
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f1938], eax
push str.CryptCATAdminEnumCatalogFromHash
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f193c], eax
push str.CryptCATAdminReleaseCatalogContext
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f1940], eax
push 0x5b3a1c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f1944], eax
cmp dword [0x5f1930], 0
je 0x533025
cmp dword [0x5f1934], 0
je 0x533025
cmp dword [0x5f1938], 0
je 0x533025
cmp dword [0x5f193c], 0
je 0x533025
cmp dword [0x5f1940], 0
je 0x533025
cmp dword [0x5f1944], 0
je 0x533025
mov dword [0x5f1948], 1
mov eax, 1
jmp 0x53303b
mov dword [0x5f1948], 2
xor eax, eax
cmp dword [0x5f1948], 1
sete al
mov esp, ebp
pop ebp
ret

Function at 0x533bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0055e2a0
add esp, 0xc
push str.360WDSafePayProtectMsgWnd
push 0x208
lea edx, [ebp - 0x210]
push edx
call fcn.004b8620
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x533c9e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x220], 0x57505350
mov edx, dword [ebp - 0x228]
push edx
call fcn.0055e532
add esp, 4
lea eax, [eax + eax + 2]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x214]
push edx
push 0x3e8
push 0
lea eax, [ebp - 0x220]
push eax
push 0
push 0x4a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x533c97
xor eax, eax
jmp 0x533ca0
mov eax, 1
jmp 0x533ca0
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret
Function at 0x535070
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x208
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.0055e2a0
add esp, 0xc
push 0x208
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x208
push ecx
call fcn.0055e2a0
add esp, 0xc
push 0x208
push 0
mov edx, dword [ebp - 4]
add edx, 0x618
push edx
call fcn.0055e2a0
add esp, 0xc
push 0x104
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp + 8], 0
je 0x5350eb
mov ecx, dword [ebp + 8]
push ecx
push 0x208
mov edx, dword [ebp - 4]
add edx, 0x618
push edx
call fcn.004b8620
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 1
push 0x1a
mov ecx, dword [ebp - 4]
add ecx, 0x208
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x535113
xor eax, eax
jmp 0x53515f
mov edx, dword [ebp - 4]
add edx, 0x618
push edx
mov eax, dword [ebp - 4]
add eax, 0x208
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 4]
add ecx, 0x208
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x53515a
push 0
mov edx, dword [ebp - 4]
add edx, 0x208
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x53515a
xor eax, eax
jmp 0x53515f
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x536450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.00451f40
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.00538ce0
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.00536740
lea ecx, [ebp - 0x438]
call fcn.00539100
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.00536220
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5364ce
call fcn.00535ef0
mov dword [ebp - 0x444], eax
jmp 0x536623
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x5364ff
call fcn.00535ef0
mov dword [ebp - 0x444], eax
jmp 0x536623
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x53652f
call fcn.00535ef0
mov dword [ebp - 0x444], eax
jmp 0x536623
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x53657f
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.00539120
lea ecx, [ebp - 0x2c]
call fcn.00538d00
mov eax, dword [ebp - 0x44c]
jmp 0x536658
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.00539150
lea ecx, [ebp - 0x438]
call fcn.00539140
test eax, eax
jne 0x5365ac
mov dword [ebp - 0x444], 0x8007000e
jmp 0x536623
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.00539140
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.00451f40
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x5365ee
call fcn.00535ef0
mov dword [ebp - 0x444], eax
jmp 0x536623
lea ecx, [ebp - 0x438]
call fcn.00539140
xor ecx, ecx
mov edx, dword [ebp - 0x43c]
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x438]
call fcn.00539140
push eax
lea ecx, [ebp - 0x18]
call fcn.00536770
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x536633
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x450], edx
lea ecx, [ebp - 0x438]
call fcn.00539120
lea ecx, [ebp - 0x2c]
call fcn.00538d00
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret 0x10
Function at 0x537e00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.004349e0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00434a40
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x537e6b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.004349f0
mov eax, dword [ebp - 0x224]
jmp 0x537efc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x537ed1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00537e00
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x537ec8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.004349f0
mov eax, dword [ebp - 0x228]
jmp 0x537efc
mov dword [ebp - 4], 0x100
jmp 0x537e72
lea ecx, [ebp - 0x14]
call fcn.00434a10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00537da0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.004349f0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret 4
Function at 0x5383d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x5383d9
xor ecx, ecx
jne 0x5383d9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x5383fa
mov eax, 0xd
jmp 0x538455
xor eax, eax
jne 0x5383e1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x53840b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x542350
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x543f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x543fac
cmp dword [ebp + 0xc], 0xffffffff
jne 0x543fb3
xor eax, eax
jmp 0x544061
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [eax + 0x14]
call edx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
test eax, eax
jne 0x54405e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x544054
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x544054
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x544047
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x14]
jne 0x544047
mov dword [ebp - 0x24], 1
jmp 0x54404e
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x545390
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x806c
call fcn.0055f2e0
mov eax, dword [0x5e6468]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x806c], ecx
mov dword [ebp - 0x4060], 0
cmp dword [ebp + 8], 0
je 0x5453c3
cmp dword [ebp + 0xc], 0
jne 0x5453ca
xor eax, eax
jmp 0x5455da
mov dword [ebp - 0x4064], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4064], eax
cmp dword [ebp - 0x4064], 0xffffffff
jne 0x54540d
xor eax, eax
jmp 0x5455da
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x54543c
jmp 0x5455ae
push 0
mov edx, dword [ebp - 0x4064]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x54545e
jmp 0x5455ae
mov dword [ebp - 0x4038], 0
mov dword [ebp - 0x4034], 0
mov dword [ebp - 0x4030], 0
push 0x38
push 0x5b6144
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x4058]
push ecx
call fcn.00410140
add esp, 0x10
mov dword [ebp - 0x405c], eax
cmp dword [ebp - 0x405c], 0
je 0x5454af
jmp 0x5455ae
mov edx, 1
test edx, edx
je 0x54559f
push 0
lea eax, [ebp - 4]
push eax
push 0x4000
lea ecx, [ebp - 0x4020]
push ecx
mov edx, dword [ebp - 0x4064]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5454e9
jmp 0x5455ae
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x4054], ecx
mov edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
and edx, 0xfffffffc
add edx, 4
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x4020]
mov dword [ebp - 0x4058], eax
mov dword [ebp - 0x4048], 0x4000
lea ecx, [ebp - 0x8068]
mov dword [ebp - 0x404c], ecx
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0x4058]
push eax
call fcn.00410be0
add esp, 8
mov dword [ebp - 0x405c], eax
mov ecx, 0x4000
sub ecx, dword [ebp - 0x4048]
mov dword [ebp - 0x18], ecx
je 0x54557f
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x8068]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x54557d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
je 0x54557f
jmp 0x545588
cmp dword [ebp - 0x4048], 0
je 0x545517
cmp dword [ebp - 0x10], 4
jne 0x54559a
mov dword [ebp - 0x4060], 1
jmp 0x54559f
jmp 0x5454af
lea ecx, [ebp - 0x4058]
push ecx
call fcn.00411a60
add esp, 4
cmp dword [ebp - 0x4064], 0xffffffff
je 0x5455c4
mov edx, dword [ebp - 0x4064]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0xffffffff
je 0x5455d4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4060]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0055e289
mov esp, ebp
pop ebp
ret 0xc