joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ae80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c
call fcn.0065d180
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0xc]
shr ecx, 3
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], ecx
cmp esi, dword [ebp + 0xc]
jb 0x52b071
nop dword [eax]
mov dword [ebp - 8], 0
test ecx, ecx
je 0x52b058
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 7]
cdq
mov edi, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 5]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 4]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 3]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 2]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 1]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
mov dword [ebp - 4], ecx
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
mov eax, edi
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
mov eax, ebx
and ecx, 0xff00ff
and eax, 0x55555555
mov dword [ebp - 0x14], ecx
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
and edi, 0xaaaaaaaa
mov dword [ebp - 0x10], ecx
lea eax, [edi + edi]
or eax, edi
and ebx, 0xaaaaaaaa
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
lea eax, [ebx + ebx]
or eax, ebx
and ecx, 0xf0f0f0f0
and eax, 0xcccccccc
mov edi, ecx
shl edi, 4
or edi, ecx
and edi, 0xff00ff00
lea ecx, [eax*4]
mov ebx, edi
or ecx, eax
shr ebx, 8
and ecx, 0xf0f0f0f0
and edi, 0xffff00
mov edx, ecx
or ebx, edi
shl edx, 4
or edx, ecx
mov edi, dword [ebp - 0x18]
and edx, 0xff00ff00
shr ebx, 8
mov eax, edx
shl eax, 8
or eax, edx
xor edx, edx
and eax, 0xffff0000
or ebx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl eax, 8
and ecx, 0xffffff00
or ecx, eax
mov eax, dword [ebp - 0x14]
shr eax, 8
or eax, dword [ebp - 0x14]
movzx eax, ax
shl ecx, 8
or ecx, eax
mov eax, dword [ebp - 8]
or edx, ecx
xor dword [edi + eax*8], edx
xor dword [edi + eax*8 + 4], ebx
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x52aec2
mov esi, dword [ebp + 8]
mov ecx, edi
call fcn.0052ad60
sub esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], esi
cmp esi, dword [ebp + 0xc]
jae 0x52aeb0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x537910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [edx + 4]
push edi
cmp esi, dword [ebx + 4]
mov edi, ecx
mov ecx, edx
cmovge ecx, ebx
cmovge ebx, edx
mov dword [ebp + 8], ecx
mov edx, dword [ebx + 4]
cmp edx, dword [edi + 8]
jg 0x537938
mov eax, edi
jmp 0x537942
mov ecx, edi
call fcn.0046e3f0
mov ecx, dword [ebp + 8]
test eax, eax
jne 0x53794b
pop edi
pop esi
pop ebx
pop ebp
ret
xor esi, esi
cmp dword [ecx + 4], esi
jle 0x53796a
mov eax, dword [ecx]
mov ecx, dword [ebx]
mov edx, dword [eax + esi*4]
xor edx, dword [ecx + esi*4]
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ecx + 4]
jl 0x537952
mov eax, dword [ebx + 4]
cmp esi, eax
jge 0x537983
mov eax, dword [ebx]
mov ecx, dword [edi]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebx + 4]
cmp esi, eax
jl 0x537971
mov dword [edi + 4], eax
test eax, eax
jle 0x5379a3
mov ecx, dword [edi]
lea ecx, [ecx + eax*4]
nop
cmp dword [ecx - 4], 0
lea ecx, [ecx - 4]
jne 0x53799e
dec eax
test eax, eax
jg 0x537990
mov dword [edi + 4], eax
test eax, eax
jne 0x5379ac
mov dword [edi + 0xc], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x537fa0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.0065d180
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov ecx, dword [ebp + 0xc]
push edi
xor edi, edi
call fcn.00494730
mov ecx, dword [ebp + 0xc]
call fcn.004948a0
mov esi, eax
test esi, esi
je 0x5381b6
mov edx, dword [ebx + 4]
add edx, edx
cmp edx, dword [esi + 8]
jle 0x537fea
mov ecx, esi
call fcn.0046e3f0
test eax, eax
je 0x5381b6
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x53816e
mov edi, ecx
nop word [eax + eax]
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x538000
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
mov dword [esi + 4], eax
test eax, eax
jle 0x538193
mov ecx, dword [esi]
lea ecx, [ecx + eax*4]
nop dword [eax]
cmp dword [ecx - 4], 0
lea ecx, [ecx - 4]
jne 0x53818e
dec eax
test eax, eax
jg 0x538180
mov dword [esi + 4], eax
test eax, eax
jne 0x53819c
mov dword [esi + 0xc], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005379c0
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.00494830
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x583610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.0065d180
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov eax, dword [eax + 0x64]
inc ebx
push edi
mov edi, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], edi
test byte [eax + 0x30], 1
mov esi, dword [edi + 8]
je 0x58368d
mov ecx, dword [ebp + 8]
lea eax, [ebx + ecx]
cmp eax, esi
ja 0x583691
add dword [edi + 0x14], ecx
sub esi, ecx
add dword [edi + 0x18], ecx
sub dword [edi + 0xc], ecx
mov ecx, dword [ebp - 4]
mov dword [edi + 8], esi
mov eax, dword [edi + 0x14]
dec eax
add eax, esi
mov dword [ebp - 8], eax
mov al, byte [eax]
movzx edx, al
mov byte [ebp + 0xf], al
mov eax, dword [ecx + 0x3cc]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test dword [eax + 0x10], 0x200000
je 0x58369a
sub esi, edx
mov eax, 1
dec esi
mov dword [edi + 8], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, esi
jbe 0x583656
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edx + ebx]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x58370e
mov ecx, dword [ebp - 4]
mov edx, ecx
mov esi, dword [ebp - 8]
shr edx, 0x1f
xor edi, edi
mov dword [ebp - 0x10], edx
sub ecx, edi
lea esi, [esi - 1]
shr ecx, 0x1f
mov eax, edi
shr eax, 0x1f
inc edi
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [ebp + 0xf]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
mov ecx, dword [ebp - 4]
not edx
and ebx, edx
mov edx, dword [ebp - 0x10]
cmp edi, dword [ebp - 0xc]
jb 0x5836d0
mov edi, dword [ebp - 0x14]
mov edx, ecx
mov esi, dword [edi + 8]
not ebx
lea eax, [edx + 1]
movzx ecx, bl
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edi + 8], esi
mov dword [ebp + 0xc], ecx
not ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x583740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa0
call fcn.0065d180
mov eax, dword [0x746694]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0xa0], ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
sub ecx, edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x98], ecx
cmp edx, edi
jb 0x58392b
cmp edi, 0x40
ja 0x58392b
lea eax, [ebp - 0x84]
neg eax
lea ecx, [ebp - 0x84]
and eax, 0x3f
add ecx, eax
lea eax, [edi + 0x100]
mov dword [ebp - 0x9c], ecx
cmp edx, eax
jbe 0x5837b8
mov ebx, edx
sub ebx, edi
sub ebx, 0x100
push esi
push edi
xor esi, esi
mov dword [ebp - 0x90], 0
push esi
push ecx
call fcn.006607e0
mov eax, dword [ebp - 0x8c]
add esp, 0xc
mov dword [ebp - 0x94], esi
cmp ebx, dword [eax + 0xc]
jae 0x58388f
mov ecx, ebx
sub ecx, dword [eax + 8]
mov dword [ebp - 0x88], ecx
mov edi, dword [ebp - 0x8c]
mov eax, ebx
xor eax, dword [ebp - 0x98]
lea edx, [eax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov eax, dword [ebp - 0x8c]
neg edx
xor ecx, dword [eax + 8]
mov eax, ebx
xor eax, dword [edi + 8]
or ecx, eax
mov eax, edx
or eax, dword [ebp - 0x90]
xor ecx, ebx
and edx, dword [ebp - 0x94]
shr ecx, 0x1f
or esi, edx
mov edx, dword [ebp - 0x94]
neg ecx
and ecx, eax
mov eax, dword [edi + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x90], ecx
mov al, byte [eax + ebx]
inc ebx
and al, cl
mov ecx, dword [ebp - 0x9c]
or byte [edx + ecx], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
mov eax, dword [ebp - 0x8c]
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [ebp - 0x88]
inc ecx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x88], ecx
cmp ebx, dword [eax + 0xc]
jb 0x5837f0
mov dword [ebp - 0x88], 0
test edi, edi
je 0x583915
mov ecx, dword [ebp - 0x9c]
mov eax, esi
and eax, 0xffffffdf
mov bl, byte [eax + ecx]
mov eax, esi
or eax, 0x20
mov dl, byte [eax + ecx]
mov eax, esi
and eax, 0x20
inc esi
dec eax
shr eax, 0x1f
neg al
movzx eax, al
mov dword [ebp - 0x90], eax
not eax
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x90]
and cl, dl
mov edx, dword [ebp - 0x88]
and al, bl
or al, cl
mov ecx, dword [ebp - 0xa0]
mov byte [ecx + edx], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
mov dword [ebp - 0x88], edx
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x5838a1
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065d16a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0065d16a
mov esp, ebp
pop ebp
ret
Function at 0x5a17e0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x5a17f8
push 2
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0x20], 0
pop esi
ret

Function at 0x5a1800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x44]
mov dword [esi + 0x40], 1
cmp ecx, eax
je 0x5a182a
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a1821
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x64]
cmp ecx, eax
je 0x5a1847
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a183e
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
lea eax, [ebp + 8]
mov byte [esi + 0x20], 1
push eax
push 0
push esi
push 0x5a0130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
pop esi
pop ebp
ret 8

Function at 0x5a1870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x44]
mov dword [esi + 0x40], 0
cmp ecx, eax
je 0x5a189a
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a1891
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x64]
cmp ecx, eax
je 0x5a18b7
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a18ae
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
lea eax, [ebp + 8]
mov byte [esi + 0x20], 1
push eax
push 0
push esi
push 0x5a0130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
pop esi
pop ebp
ret 8

Function at 0x5a18e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
lea ecx, [esi + 0x64]
mov dword [esi + 0x40], 2
cmp ecx, eax
je 0x5a190a
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a1901
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x60], eax
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push 0x5a0130
push 0
push 0
mov byte [esi + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
pop esi
pop ebp
ret 0xc
Function at 0x5bc6d0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x5bc712
push 2
push dword [esi + 0x12c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xb8]
mov byte [esi + 0x20], 0
test eax, eax
je 0x5bc706
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi + 0xb8], 0
push dword [esi + 0x158]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x5bc8a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [esi + 0xc8]
mov dword [eax + 0x10], 0
mov byte [esi + 0xe0], 1
mov byte [esi + 0x21], 0
mov dword [esi + 0x104], 0
cmp dword [eax + 0x14], 0x10
jb 0x5bc8d1
mov eax, dword [eax]
mov byte [eax], 0
lea eax, [esi + 0x24]
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 0x10
jb 0x5bc8e6
mov eax, dword [eax]
mov byte [eax], 0
lea ecx, [esi + 0xe4]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
je 0x5bc909
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5bc900
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x5bc92c
lea ecx, [esi + 0x10c]
cmp ecx, eax
je 0x5bc92c
cmp dword [eax + 0x14], 0x10
jb 0x5bc925
mov eax, dword [eax]
push edx
push eax
call fcn.004484a0
push dword [ebp + 8]
mov ecx, esi
call fcn.005bd410
cmp dword [esi + 0x11c], 0
je 0x5bc95f
push edi
lea edi, [esi + 0x10c]
push edi
call fcn.005c0b20
add esp, 4
test al, al
je 0x5bc95e
push 1
push edi
call fcn.005bea30
add esp, 8
pop edi
lea eax, [ebp - 4]
mov byte [esi + 0x20], 1
push eax
push 0
push esi
push 0x5bbea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi + 0x150], 0
mov dword [esi + 0x12c], eax
jne 0x5bc991
cmp dword [esi + 0x154], 0
je 0x5bc998
mov ecx, esi
call fcn.005bd150
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5bd770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x11c], 0
je 0x5bd7a0
push edi
lea edi, [esi + 0x10c]
push edi
call fcn.005c0b20
add esp, 4
test al, al
je 0x5bd79f
push 1
push edi
call fcn.005bea30
add esp, 8
pop edi
lea eax, [ebp - 4]
mov byte [esi + 0x20], 1
push eax
push 0
push esi
push 0x5bb160
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi + 0x150], 0
mov dword [esi + 0x12c], eax
jne 0x5bd7d2
cmp dword [esi + 0x154], 0
je 0x5bd7d9
mov ecx, esi
call fcn.005bd150
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bf860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68a979
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x746694]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x10]
call fcn.005be920
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
add esp, 8
push eax
push 0x20019
push 0
push edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5bf903
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
test edi, edi
je 0x5bf8ef
push edi
call fcn.00663ce7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x14]
call fcn.005be920
push 0x800
push 0
mov dword [ebp - 0x24], 0x400
call fcn.00663d02
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x28], esi
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push 0
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
je 0x5bf976
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
jmp 0x5bf996
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x5bf989
cmp eax, 7
jne 0x5bf95a
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.005be990
add esp, 8
test esi, esi
je 0x5bf9a3
push esi
call fcn.00663ce7
add esp, 4
test ebx, ebx
je 0x5bf9b0
push ebx
call fcn.00663ce7
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5bf9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
call fcn.005be920
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 4]
add esp, 8
push eax
push 0x20019
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5bfa54
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
call fcn.005be920
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
add esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x5bfa6b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
test esi, esi
je 0x5bfa63
push esi
call fcn.00663ce7
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
jmp 0x5bfa56
Function at 0x5bfa80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
call fcn.005be920
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5bfad0
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x5bfb42
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
call fcn.005be920
push 0x800
push 0
call fcn.00663d02
add esp, 0x10
mov dword [ebp - 8], 0x400
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x5bfb29
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x5bfb34
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebx]
mov esi, dword [ebx + 4]
test ebx, ebx
je 0x5bfb41
push ebx
call fcn.00663ce7
add esp, 4
pop ebx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x5bfb52
push eax
call fcn.00663ce7
add esp, 4
mov eax, edi
mov edx, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5bfb60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0
call fcn.005be920
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 8]
add esp, 8
push eax
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x5bfbac
xor bl, bl
jmp 0x5bfc0d
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
call fcn.005be920
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp + 0x14]
mov dword [ebp - 0x14], 0
call fcn.005be920
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov edi, dword [ebp - 0x18]
add eax, eax
mov esi, dword [ebp - 0x10]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x5bfc0c
push edi
call fcn.00663ce7
add esp, 4
pop edi
test esi, esi
je 0x5bfc1a
push esi
call fcn.00663ce7
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret