joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ff6a0
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..GlobalAvg7Rs
mov dword [esp + 0x2c], ebx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ff702
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str.Avg7Rs
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ff702
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
cmp ebx, 2
jne 0x4ff6fe
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
test ebx, ebx
jne 0x4ff75e
cmp byte [esp + 0x1c], 0
push 0
je 0x4ff725
lea eax, [esp + 0x14]
push eax
push 4
push ebp
push 0
push 0
push 0x5349a00c
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
jmp 0x4ff744
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 4
push ebp
push 0x5349a010
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov dword [ebp], 0
test eax, eax
jne 0x4ff750
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
cmp esi, 0xffffffff
je 0x4ff75c
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
pop edi
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret

Function at 0x4ff770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov esi, eax
movzx eax, word [esp + 0x14]
push str.RT_BINARY
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4ff79e
pop edi
pop esi
pop ebx
jmp dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ebx, eax
cmp ebx, 0x100
jae 0x4ff7b9
mov eax, 0x32
pop edi
pop esi
pop ebx
ret
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x4ff7ce
pop edi
pop esi
pop ebx
jmp dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
jne 0x4ff7e2
pop edi
pop esi
pop ebx
jmp dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.004fd8f0
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4ff820
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push edi
push esi
lea eax, [esp + 0xc]
push str.Global_s
push eax
call fcn.00508453
mov edi, dword [sym.imp.KERNEL32.DLL_OpenMutexA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0
push 0x100000
call edi
test eax, eax
je 0x4ff881
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005078c8
add esp, 0x108
ret
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
call ebx
cmp eax, 5
je 0x4ff893
cmp eax, 6
jne 0x4ff8ac
pop edi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005078c8
add esp, 0x108
ret
push esi
lea edx, [esp + 0xc]
push str.Local_s
push edx
call fcn.00508453
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0
push 0x100000
call edi
test eax, eax
jne 0x4ff861
call ebx
cmp eax, 5
je 0x4ff893
cmp eax, 6
je 0x4ff893
push esi
push 0
push 0x100000
call edi
test eax, eax
jne 0x4ff861
call ebx
cmp eax, 5
je 0x4ff893
cmp eax, 6
je 0x4ff893
mov ecx, dword [esp + 0x10c]
pop edi
pop ebx
xor ecx, esp
xor al, al
call fcn.005078c8
add esp, 0x108
ret

Function at 0x4ffca0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c8
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x1c4], eax
mov eax, dword [esp + 0x1cc]
push ebx
push ebp
push esi
push edi
push ecx
push 0
push 0x10
mov edi, edx
mov dword [esp + 0x20], eax
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x4ffd7d
mov ebp, dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
lea edx, [esp + 0x10]
push edx
push 0x40
lea eax, [esp + 0x118]
push eax
push edi
push esi
call ebp
mov ecx, 0x5a4d
cmp word [esp + 0x110], cx
jne 0x4ffd76
mov eax, dword [esp + 0x14c]
cmp eax, 4
jl 0x4ffd76
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
lea ecx, [esp + 0x20]
push ecx
lea edx, [edi + eax]
push edx
push esi
call ebp
cmp dword [esp + 0x18], 0x4550
jne 0x4ffd76
test dword [esp + 0x2e], 0x2000
jne 0x4ffd76
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x10]
push eax
push 0x80
lea ecx, [esp + 0x158]
push ecx
add edi, edx
push edi
push esi
call ebp
cmp dword [esp + 0x10], 0x80
jne 0x4ffd76
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x150]
call fcn.00418eb0
test al, al
je 0x4ffd76
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x1d4]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x1c8
ret

Function at 0x4ffe50
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push eax
xor edi, edi
push edi
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x4ffe85
push 3
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
jne 0x4ffe79
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.DLL_GetLastError]
Function at 0x5003b0
Capabilities:
Terminate process

Disassembly:
call fcn.005002d0
xor ecx, ecx
test eax, eax
je 0x5003fb
push esi
push edi
push eax
xor edi, edi
push edi
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x5003f0
push 3
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
jne 0x5003e4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
pop edi
pop esi
ret
mov eax, ecx
ret

Function at 0x5004c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [esp + 8]
movzx eax, word [eax]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
movzx edi, ax
shr edi, 1
cmp word [ebx], 0x5c
mov esi, ecx
jne 0x5004ea
mov edi, edi
add ebx, 2
dec ebp
cmp word [ebx], 0x5c
je 0x5004e0
mov ecx, dword fs:[0x18]
lea eax, [eax + ebp*2 + 2]
mov word [esi], ax
add eax, 2
movzx edx, ax
mov word [esi + 2], ax
mov eax, dword [ecx + 0x30]
mov ecx, dword [eax + 0x18]
push edx
push 8
push ecx
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov dword [esi + 4], eax
test eax, eax
jne 0x500520
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov ecx, dword [esp + 0x14]
movzx edx, word [ecx]
mov ecx, dword [ecx + 4]
push edx
push ecx
push eax
call fcn.005186a0
mov edx, dword [esi + 4]
mov eax, 0x5c
mov word [edx + edi*2], ax
mov ecx, dword [esi + 4]
lea esi, [ecx + edi*2 + 2]
lea edi, [ebp + ebp]
push edi
push ebx
push esi
call fcn.005186a0
add esp, 0x18
xor edx, edx
mov word [edi + esi], dx
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x500730
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov esi, eax
xor eax, eax
push edi
xor ecx, ecx
xor edi, edi
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
lea eax, [ebx + 1]
mov dword [esp + 0x10], ebx
cmp byte [ebp + 0x10], bl
je 0x500769
mov eax, 3
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
xor eax, eax
call fcn.00500570
add esp, 0xc
test eax, eax
jge 0x50078d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, ebx
jne 0x5007a5
xor ecx, ecx
xor edx, edx
mov word [esp + 0x18], cx
mov word [esp + 0x1a], dx
mov dword [esp + 0x1c], ebx
jmp 0x5007d2
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x5007b0
sub eax, edx
sar eax, 1
add eax, eax
lea ecx, [eax + 2]
mov word [esp + 0x1a], cx
mov word [esp + 0x18], ax
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.Ntdll.dll_NtQueryValueKey]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
push eax
push ebx
push 2
lea ecx, [esp + 0x28]
push ecx
push edx
call esi
cmp dword [esp + 0x10], ebx
je 0x50082f
mov eax, dword fs:[0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x30]
mov eax, dword [edx + 0x18]
push ecx
push ebx
push eax
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
je 0x50082f
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push edi
push 2
lea eax, [esp + 0x28]
push eax
push ecx
call esi
cmp byte [ebp + 0x10], bl
je 0x500844
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.Ntdll.dll_NtDeleteValueKey]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.Ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x500860
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push esi
test edx, edx
jne 0x500872
xor eax, eax
xor ecx, ecx
mov dword [esp + 0xc], eax
jmp 0x50088f
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x500877
sub eax, esi
sar eax, 1
add eax, eax
lea ecx, [eax + 2]
mov dword [esp + 0xc], edx
lea edx, [esp + 4]
push edx
mov word [esp + 0xc], ax
mov eax, dword [esp + 0x1c]
push 2
mov word [esp + 0x12], cx
push eax
xor eax, eax
mov ecx, edi
call fcn.00500570
add esp, 0xc
test eax, eax
jl 0x5008e1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push edx
mov edx, dword [esp + 0xc]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.Ntdll.dll_NtSetValueKey]
push edi
mov esi, eax
call dword [sym.imp.Ntdll.dll_NtFlushKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x500a20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push esi
push edi
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
xor edi, edi
call fcn.00500730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x500a63
mov eax, dword [esi + 8]
lea ecx, [esi + 0xc]
shr eax, 1
push ecx
call fcn.004fef10
mov edx, dword fs:[0x18]
add esp, 4
mov edi, eax
mov eax, dword [edx + 0x30]
mov ecx, dword [eax + 0x18]
push esi
push 0
push ecx
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
ret

Function at 0x500a70
Capabilities:
Access peb ldr_data
Get process heap flags
Persist via run registry key

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor eax, eax
xor ecx, ecx
push edi
mov edx, 0x80000001
cmp ebx, 0x1c
je 0x500ab2
cmp ebx, 0x26
je 0x500aa1
cmp ebx, 0x2a
jne 0x500abc
mov eax, str.ProgramFilesDir__x86_
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersion
mov edx, 0x80000002
jmp 0x500abc
mov eax, str.ProgramFilesDir
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersion
mov edx, 0x80000002
jmp 0x500abc
mov eax, str.Local_AppData
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
xor edi, edi
push edi
push ecx
push edx
call fcn.00500730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x500af9
mov eax, dword [esi + 8]
lea ecx, [esi + 0xc]
shr eax, 1
push ecx
call fcn.004fef10
mov edx, dword fs:[0x18]
add esp, 4
mov edi, eax
mov eax, dword [edx + 0x30]
mov ecx, dword [eax + 0x18]
push esi
push 0
push ecx
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
test edi, edi
jne 0x500b11
cmp ebx, 0x2a
jne 0x500b11
push 0x26
call fcn.00500a70
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x500c40
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
mov eax, dword fs:[0x18]
push ebx
push edi
mov edi, dword [esi]
mov dword [esp + 8], 0x1000
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x18]
push 0x1000
push 8
push ecx
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x500c76
pop edi
mov eax, 0xe0010001
pop ebx
pop ecx
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 8]
push edx
push eax
push ebx
push 0
push ecx
push edi
call dword [sym.imp.Ntdll.dll_NtEnumerateKey]
mov edi, eax
test edi, edi
jl 0x500cdb
mov eax, dword [esi + 4]
push ebp
mov ebp, dword [ebx + 0xc]
shr ebp, 1
lea edi, [ebp + ebp + 2]
call fcn.00418880
mov edi, eax
mov dword [esi + 4], edi
test edi, edi
jne 0x500cb7
mov edi, 0xc000009a
jmp 0x500cda
lea eax, [ebp + ebp]
push eax
lea edx, [ebx + 0x10]
push edx
push edi
call fcn.005186a0
xor eax, eax
mov word [edi + ebp*2], ax
add esp, 0xc
xor edi, edi
mov dword [esi + 8], ebp
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
pop ebp
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
mov eax, dword [edx + 0x18]
push ebx
push 0
push eax
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x500d00
Capabilities:
Access peb ldr_data
Get ntdll base address
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword fs:[0x18]
mov ebx, dword [esi]
push edi
mov dword [esp + 0xc], 0x1000
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x18]
push 0x1000
push 8
push ecx
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x500d3a
pop edi
pop esi
mov eax, 0xe0010001
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push eax
push edi
push 1
push ecx
push ebx
call dword [sym.imp.Ntdll.dll_NtEnumerateValueKey]
mov ebx, eax
test ebx, ebx
jl 0x500d79
mov edx, dword [edi + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0x10]
push edx
add eax, edi
push eax
mov eax, dword [edi + 4]
push ecx
lea edx, [edi + 0x14]
push edx
push eax
call fcn.005008f0
add esp, 0x14
mov ebx, eax
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
mov eax, dword [edx + 0x18]
push edi
push 0
push eax
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x500da0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x10
mov edx, dword [edi + 4]
xor eax, eax
xor ecx, ecx
mov word [esp + 4], ax
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
push esi
mov word [esp + 0xa], cx
test edx, edx
je 0x500e0a
test eax, eax
jne 0x500ddf
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x500dd0
sub eax, esi
sar eax, 1
add eax, eax
lea ecx, [eax + 2]
mov word [esp + 0xa], cx
mov word [esp + 8], ax
mov dword [esp + 0xc], edx
test ax, ax
je 0x500e0a
mov eax, dword [edi]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.Ntdll.dll_NtDeleteValueKey]
pop esi
add esp, 0x10
ret
mov eax, 0xe0010001
pop esi
add esp, 0x10
ret
Function at 0x500f90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x624
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x620], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
test edi, edi
je 0x500fe1
test esi, esi
jne 0x500fe1
mov eax, edi
lea edx, [eax + 2]
jmp 0x500fd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x500fd0
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 8
push edi
mov eax, esi
mov ecx, ebx
call fcn.00500570
add esp, 0xc
cmp eax, 0xc0000022
jne 0x501017
mov eax, esi
call fcn.00500e90
lea ecx, [esp + 0x10]
push ecx
push 8
push edi
xor eax, eax
mov ecx, ebx
call fcn.00500570
add esp, 0xc
test eax, eax
jl 0x5010cf
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x400
lea eax, [esp + 0x230]
push eax
push 0
push 0
push ecx
call dword [sym.imp.Ntdll.dll_NtEnumerateKey]
test eax, eax
jne 0x5010c4
jmp 0x501050
mov eax, dword [esp + 0x234]
shr eax, 1
mov dword [esp + 0x14], eax
add eax, eax
push eax
lea edx, [esp + 0x23c]
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x28]
push eax
call fcn.005186a0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
xor ecx, ecx
add esp, 0xc
mov word [esp + edx + 0x20], cx
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.00500f90
add esp, 0xc
test eax, eax
jl 0x5010c4
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x400
lea ecx, [esp + 0x230]
push ecx
push 0
push 0
push edx
call dword [sym.imp.Ntdll.dll_NtEnumerateKey]
test eax, eax
je 0x501050
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.Ntdll.dll_NtClose]
lea ecx, [esp + 0x10]
push ecx
push 0x10000
push edi
mov eax, esi
mov ecx, ebx
call fcn.00500570
add esp, 0xc
cmp eax, 0xc0000022
jne 0x50110b
mov eax, esi
call fcn.00500e90
lea edx, [esp + 0x10]
push edx
push 0x10000
push edi
xor eax, eax
mov ecx, ebx
call fcn.00500570
add esp, 0xc
test eax, eax
jl 0x501129
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.Ntdll.dll_NtDeleteKey]
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.Ntdll.dll_NtClose]
mov eax, esi
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005078c8
mov esp, ebp
pop ebp
ret

Function at 0x501350
Capabilities:
Access peb ldr_data
Get kernel32 base address
Write file on windows

Disassembly:
sub esp, 8
test esi, esi
je 0x50139e
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push 0
push 0
sub ecx, eax
push ecx
push eax
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.Ntdll.dll_NtWriteFile]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push edx
mov dword [esi + 4], ecx
call dword [sym.imp.Ntdll.dll_NtClose]
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0x18]
push esi
push 0
push edx
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
add esp, 8
ret
Function at 0x5013b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.Ntdll.dll_NtWriteFile]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jb 0x5013ec
mov ecx, dword [esi]
push 0
push 0
sub eax, ecx
push eax
push ecx
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push ecx
call edi
mov edx, dword [esi]
mov dword [esi + 4], edx
movzx eax, bx
test eax, eax
jne 0x5013f8
lea ebx, [eax + 0x20]
jmp 0x5013c4
cmp eax, 0xa
jne 0x501408
push 0xd
push esi
call fcn.005013b0
add esp, 8
mov eax, dword [esi + 4]
mov byte [eax], bl
mov edi, 1
add dword [esi + 4], edi
cmp dword [esi + 0x14], 0
mov eax, dword [esi + 4]
je 0x501428
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
add dword [esi + 4], edi
cmp bx, 0xa
jne 0x50143a
xor eax, eax
pop edi
mov dword [esi + 0x10], eax
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x10]
add eax, edi
pop edi
mov dword [esi + 0x10], eax
pop esi
pop ebx
add esp, 8
ret
Function at 0x501760
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x43c], eax
mov eax, dword [esp + 0x448]
push ebx
push ebp
mov ebp, dword [esp + 0x44c]
mov dword [esp + 0x24], eax
mov ax, word [0x986f90]
movzx ecx, ax
push esi
mov esi, dword [esp + 0x458]
movzx edx, word [esi]
movzx ebx, ax
mov dword [esp + 0x18], ecx
movzx ecx, word [0x986f92]
push edi
xor edi, edi
lea eax, [edx + ebx + 2]
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], ebx
cmp eax, ecx
ja 0x5017e9
push 0x978ed4
push 0x986f90
call dword [sym.imp.Ntdll.dll_RtlAppendUnicodeToString]
push esi
push 0x986f90
call dword [sym.imp.Ntdll.dll_RtlAppendUnicodeStringToString]
mov eax, 0x986f90
mov edi, ebp
call fcn.00501520
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x30]
push eax
push 9
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x3c], 0x18
mov dword [esp + 0x40], edx
mov dword [esp + 0x48], 0x40
mov dword [esp + 0x44], esi
call dword [sym.imp.Ntdll.dll_NtOpenKey]
mov esi, eax
test esi, esi
jl 0x50190c
jne 0x501882
mov esi, dword [sym.imp.Ntdll.dll_NtEnumerateValueKey]
mov ebx, dword [sym.imp.Ntdll.dll_RtlReAllocateHeap]
lea esp, [esp]
mov eax, dword [0x987618]
mov ecx, dword [0x9855d4]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push ecx
push eax
push 1
push edi
push edx
call esi
cmp eax, 0x80000005
je 0x501931
cmp eax, 0xc0000023
je 0x501931
test eax, eax
jne 0x501882
mov ecx, ebp
call fcn.00501590
inc edi
test eax, eax
je 0x501840
push 0xa
push ebp
call fcn.005013b0
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.Ntdll.dll_NtEnumerateKey]
add esp, 8
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x50]
push ecx
xor ebx, ebx
push ebx
push ebx
push edx
call edi
mov esi, eax
test esi, esi
jne 0x5018fd
mov ax, word [esp + 0x54]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
mov word [esp + 0x26], ax
mov word [esp + 0x24], ax
push edx
lea eax, [esp + 0x60]
push ebp
mov dword [esp + 0x30], eax
call fcn.00501760
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x50]
push ecx
push 0
inc ebx
push ebx
push edx
call edi
mov esi, eax
test esi, esi
je 0x5018b3
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.Ntdll.dll_NtClose]
mov ebx, dword [esp + 0x18]
mov edx, dword [0x986f94]
mov ax, word [esp + 0x1c]
shr ebx, 1
xor ecx, ecx
mov word [edx + ebx*2], cx
mov word [0x986f90], ax
cmp esi, 0x8000001a
jne 0x50196a
xor eax, eax
jmp 0x50196c
mov eax, dword fs:[0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [0x987618]
mov eax, dword [eax + 0x30]
push ecx
mov ecx, dword [eax + 0x18]
push edx
push 0
push ecx
call ebx
mov dword [0x987618], eax
test eax, eax
je 0x501882
mov edx, dword [esp + 0x14]
mov dword [0x9855d4], edx
jmp 0x501845
mov eax, esi
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x440
ret