joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5057aa
Capabilities:
Delete file

Disassembly:
push 0x58
mov eax, 0x69c81a
call fcn.0056e23b
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.004173bc
and dword [ebp - 4], 0
push 8
pop ebx
test edi, edi
je 0x5058c9
cmp dword [esi + 0x18], 0
je 0x5058c9
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00504fab
test eax, eax
je 0x5058c9
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.004173bc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
push str._AppData_Apple_ComputerPreferencescom.apple.Safari.plist
call fcn.004179fb
cmp dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
push edi
call fcn.004552fa
cmp dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x30], ebx
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x64]
push 0x6ebb48
push eax
call fcn.0041ccda
add esp, 0x1c
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], ebx
mov ecx, esi
cmovae eax, dword [ebp - 0x60]
push eax
call fcn.00504eb8
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
mov ecx, esi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0050535e
test eax, eax
je 0x5058b1
cmp dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x14], ebx
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x64]
push 0x6eba0c
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], ebx
mov ecx, esi
cmovae eax, dword [ebp - 0x60]
push eax
call fcn.00504eb8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041786a
cmp dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
xor eax, eax
inc eax
call fcn.0056e1e5
ret 4

Function at 0x5063dd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp dword [ebp - 0x108], 2
jne 0x50641c
cmp dword [ebp - 0x114], 6
ja 0x50642f
cmp dword [ebp - 0x110], eax
jbe 0x50642d
cmp dword [ebp - 0x114], 6
je 0x50642f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret
Function at 0x50643d
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
jne 0x5064ff
push str.vaultcli.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 4], eax
test eax, eax
je 0x5064ff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VaultEnumerateItems
push eax
call esi
push str.VaultEnumerateVaults
push dword [edi + 4]
mov dword [edi + 8], eax
call esi
push str.VaultFree
push dword [edi + 4]
mov dword [edi + 0x20], eax
call esi
push 0x6ebe30
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.VaultGetItem
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.VaultOpenVault
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
push str.VaultCloseVault
push dword [edi + 4]
mov dword [edi + 0x18], eax
call esi
push str.VaultRemoveItem
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call esi
mov dword [edi + 0x24], eax
pop esi
cmp dword [edi + 0x20], ebx
je 0x5064f8
cmp dword [edi + 0xc], ebx
je 0x5064f8
cmp dword [edi + 0x10], ebx
je 0x5064f8
cmp dword [edi + 0x14], ebx
je 0x5064f8
cmp dword [edi + 0x18], ebx
je 0x5064f8
cmp dword [edi + 0x1c], ebx
je 0x5064f8
cmp dword [edi + 8], ebx
je 0x5064f8
xor eax, eax
inc eax
jmp 0x506501
mov ecx, edi
call fcn.005061f2
xor eax, eax
pop edi
pop ebx
ret
Function at 0x50e6bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 1
push dword [ebp + 8]
call fcn.00567b83
mov edi, eax
mov byte [ebp + 0xb], 0
pop ecx
pop ecx
test edi, edi
je 0x50e766
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 0
mov esi, dword [ebp + 0x10]
je 0x50e74f
push ebx
push dword [ebp - 4]
call fcn.0056e306
mov ebx, eax
pop ecx
test ebx, ebx
je 0x50e74e
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x50e744
cmp dword [ebp - 8], 1
je 0x50e738
cmp dword [ebp - 8], 2
jne 0x50e744
push ebx
mov ecx, esi
call fcn.004041d0
mov byte [ebp + 0xb], 1
push 1
push ebx
call fcn.0056df27
pop ecx
pop ecx
pop ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0xb], 0
je 0x50e766
cmp dword [esi + 0x14], 8
jb 0x50e768
mov esi, dword [esi]
jmp 0x50e768
xor esi, esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x50f5ff
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test al, 1
je 0x50f60e
xor eax, eax
inc eax
pop ebp
ret
test al, 2
je 0x50f617
push 2
pop eax
pop ebp
ret
test al, 4
je 0x50f61f
push 3
jmp 0x50f614
test al, 8
je 0x50f627
push 4
jmp 0x50f614
test al, 0x10
je 0x50f62f
push 5
jmp 0x50f614
test al, 0x20
je 0x50f637
push 6
jmp 0x50f614
test al, 0x40
je 0x50f63f
push 7
jmp 0x50f614
test al, al
jns 0x50f647
push 8
jmp 0x50f614
test eax, 0x100
je 0x50f652
push 9
jmp 0x50f614
test eax, 0x200
je 0x50f65d
push 0xa
jmp 0x50f614
test eax, 0x400
je 0x50f668
push 0xb
jmp 0x50f614
test eax, 0x800
je 0x50f673
push 0xc
jmp 0x50f614
test eax, 0x1000
je 0x50f67e
push 0xd
jmp 0x50f614
test eax, 0x2000
je 0x50f689
push 0xe
jmp 0x50f614
test eax, 0x4000
je 0x50f694
push 0xf
jmp 0x50f614
test eax, 0x8000
je 0x50f6a2
push 0x10
jmp 0x50f614
test eax, 0x10000
je 0x50f6b0
push 0x11
jmp 0x50f614
test eax, 0x20000
je 0x50f6be
push 0x12
jmp 0x50f614
test eax, 0x40000
je 0x50f6cc
push 0x13
jmp 0x50f614
test eax, 0x80000
je 0x50f6da
push 0x14
jmp 0x50f614
test eax, 0x100000
je 0x50f6e8
push 0x15
jmp 0x50f614
test eax, 0x200000
je 0x50f6f6
push 0x16
jmp 0x50f614
test eax, 0x400000
je 0x50f704
push 0x17
jmp 0x50f614
test eax, 0x800000
je 0x50f712
push 0x18
jmp 0x50f614
test eax, 0x1000000
je 0x50f720
push 0x19
jmp 0x50f614
test eax, 0x2000000
je 0x50f72e
push 0x1a
jmp 0x50f614
test eax, 0x4000000
je 0x50f73c
push 0x1b
jmp 0x50f614
test eax, 0x8000000
je 0x50f74a
push 0x1c
jmp 0x50f614
test eax, 0x10000000
je 0x50f758
push 0x1d
jmp 0x50f614
test eax, 0x20000000
je 0x50f766
push 0x1e
jmp 0x50f614
and eax, 0x40000000
neg eax
sbb eax, eax
and eax, 0x1e
inc eax
pop ebp
ret
Function at 0x511280
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
cmp eax, 0x1e
ja case.0x511290.1
jmp dword [eax*4 + 0x511360]
push 2
pop eax
pop ebp
ret
push 4
jmp 0x511299
push 8
jmp 0x511299
push 0x10
jmp 0x511299
push 0x20
jmp 0x511299
push 0x40
jmp 0x511299
mov eax, 0x80
pop ebp
ret
mov eax, 0x100
pop ebp
ret
mov eax, 0x200
pop ebp
ret
mov eax, 0x400
pop ebp
ret
mov eax, 0x800
pop ebp
ret
mov eax, 0x1000
pop ebp
ret
mov eax, 0x2000
pop ebp
ret
mov eax, 0x4000
pop ebp
ret
mov eax, 0x8000
pop ebp
ret
mov eax, 0x10000
pop ebp
ret
mov eax, 0x20000
pop ebp
ret
mov eax, 0x40000
pop ebp
ret
mov eax, 0x80000
pop ebp
ret
mov eax, 0x100000
pop ebp
ret
mov eax, 0x200000
pop ebp
ret
mov eax, 0x400000
pop ebp
ret
mov eax, 0x800000
pop ebp
ret
mov eax, 0x1000000
pop ebp
ret
mov eax, 0x2000000
pop ebp
ret
mov eax, 0x4000000
pop ebp
ret
mov eax, 0x8000000
pop ebp
ret
mov eax, 0x10000000
pop ebp
ret
mov eax, 0x20000000
pop ebp
ret
mov eax, 0x40000000
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x5297f2
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0xc], esi
je 0x529831
cmp dword [edi + 0x18], esi
jne 0x529831
push esi
push esi
push esi
push esi
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x529831
push esi
push esi
push edi
push 0x529888
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [edi + 0x18], eax
inc ecx
test eax, eax
cmovne esi, ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x52b06a
Capabilities:
Create process on windows
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6f68d4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x6f68d8]
push esi
mov dword [ebp - 8], eax
xor esi, esi
mov eax, dword [ebp + 8]
add eax, 0x41
push esi
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x2c0]
push 0x2b4
push eax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 1
push esi
push esi
lea eax, [ebp - 0xc]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret

Function at 0x52db7d
Capabilities:
Check mutex on windows

Disassembly:
push esi
xor esi, esi
cmp dword [0x7e7288], esi
jne 0x52dbc0
push 0x6f6cb0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x7e7288], eax
test eax, eax
je 0x52dbc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x52dbc0
push dword [0x7e7288]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7e7288], esi
jmp 0x52dbc3
xor esi, esi
inc esi
mov eax, esi
pop esi
ret
Function at 0x52dc09
Capabilities:
Check mutex on windows

Disassembly:
push esi
xor esi, esi
cmp dword [0x7e7288], esi
jne 0x52dc4c
push 0x6f6cf8
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x7e7288], eax
test eax, eax
je 0x52dc4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x52dc4c
push dword [0x7e7288]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7e7288], esi
jmp 0x52dc4f
xor esi, esi
inc esi
mov eax, esi
pop esi
ret

Function at 0x52dc9d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [0x7e7288], esi
jne 0x52dce8
push 0x6f6c90
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x7e7288], eax
test eax, eax
je 0x52dceb
cmp dword [ebp + 8], esi
jne 0x52dce8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x52dce8
push dword [0x7e7288]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7e7288], esi
jmp 0x52dceb
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x52dd14
Capabilities:
Check mutex on windows

Disassembly:
push esi
xor esi, esi
cmp dword [0x7e728c], esi
jne 0x52dd5c
push 0x6f6d38
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x7e728c], eax
test eax, eax
je 0x52dd5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x52dd57
push dword [0x7e728c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7e728c], esi
jmp 0x52dd5f
xor eax, eax
inc eax
pop esi
ret
xor esi, esi
inc esi
mov eax, esi
pop esi
ret

Function at 0x52ef0b
Capabilities:
Read file via mapping

Disassembly:
push 0x20
mov eax, 0x68e2b1
call fcn.0056e23b
cmp dword [ebp + 8], 0
je 0x52ef9c
lea ecx, [ebp - 0x2c]
call fcn.004173bc
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push dword [ebp + 8]
push 0x6f6f20
push 0x6f6f40
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x52ef90
mov edi, 0x7967a8
mov ecx, edi
call fcn.0052a751
push ebx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push eax
mov ecx, edi
call fcn.0052a90d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x79670c]
call fcn.0055843a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
call fcn.0056e1e5
ret
Function at 0x52fba9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xec]
cmp eax, edi
je 0x52fc2a
cmp edi, 1
je 0x52fbdd
cmp edi, 2
je 0x52fbdd
push 0xffffffffffffffff
push dword [esi + 0xa4]
mov dword [esi + 0xec], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x52fc1d
cmp eax, 1
je 0x52fc1d
cmp eax, 2
je 0x52fc1d
xor eax, eax
cmp dword [esi + 0xa4], eax
jne 0x52fc1d
push eax
push eax
push esi
push 0x52fc30
push eax
push eax
mov dword [esi + 0xec], edi
mov dword [esi + 0xe8], 0x438a8000
mov dword [esi + 0xa0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xa4], eax
mov eax, dword [esi]
mov ecx, esi
mov dword [esi + 0xec], edi
call dword [eax + 0x20]
pop edi
pop esi
pop ebp
ret 4

Function at 0x53064d
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi], eax
jne 0x530671
push eax
push eax
push esi
push 0x53165a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x530671
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x531982
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push 0x70
mov eax, 0x6a14a3
call fcn.0056e23b
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [esi]
call dword [eax + 0x44]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x7c]
sub ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push 0
push ebx
push eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ebx
call fcn.00583581
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x6ae010]
lea eax, [ebp - 0x3c]
push eax
divsd xmm1, xmm0
movsd qword [ebp - 0x54], xmm1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
call fcn.0056e920
lea eax, [ebp - 0x4c]
movsd qword [ebp - 0x34], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edi, edi
cmp dword [esi + 0x1e8], edi
jne 0x531b0d
movsd xmm0, qword [0x6f7598]
divsd xmm0, qword [ebp - 0x34]
movsd qword [ebp - 0x34], xmm0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x40]
sbb edx, dword [ebp - 0x48]
call fcn.0056e920
mulsd xmm0, qword [ebp - 0x34]
mov ecx, 0xff
movsd xmm2, qword [0x6b7670]
mulsd xmm0, qword [ebp - 0x54]
addsd xmm0, xmm2
cvttsd2si eax, xmm0
sub ebx, eax
cmp edi, ecx
jge 0x531aac
movsd xmm0, qword [0x6f7590]
movd xmm1, eax
mov eax, dword [ebp - 0x24]
cvtdq2pd xmm1, xmm1
movd xmm3, eax
cvtdq2pd xmm3, xmm3
mulsd xmm1, qword [0x6f3fc8]
divsd xmm0, xmm3
mulsd xmm1, xmm0
addsd xmm1, xmm2
cvttsd2si edi, xmm1
cmp edi, ecx
cmovg edi, ecx
test ebx, ebx
jle 0x531b0d
lea ecx, [ebp - 0x7c]
call fcn.0058370e
mov ecx, dword [ebp - 0x28]
push edi
push ebx
push 0
call fcn.00451480
push eax
lea ecx, [ebp - 0x7c]
call fcn.00583866
lea ecx, [ebp - 0x7c]
call fcn.0052907d
mov ebx, dword [ebp - 0x24]
mov ecx, esi
push eax
mov eax, dword [esi]
push ebx
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [eax + 0x40]
mov ecx, eax
call fcn.00580987
mov ecx, eax
call fcn.00582bd6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x1e8], 0
je 0x531a34
cmp dword [esi + 0x1e8], 0
je 0x531b2a
mov eax, dword [esi]
mov ecx, esi
push 0
push 0
push 0x10
call dword [eax + 0x44]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00583619
call fcn.0056e1e5
ret 8
Function at 0x53744a
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8210
call fcn.0056e5a0
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0xf003f
push eax
mov dword [ebp - 0x8210], edi
call fcn.00567b83
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x53753e
lea eax, [ebp - 0x8208]
mov dword [ebp - 0x8208], esi
push eax
push 0xf003f
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x53753b
mov eax, 0x100
push eax
mov dword [ebp - 0x820c], eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x8208]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x5374e0
push dword [ebp - 0x8208]
call edi
jmp 0x53753b
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x820c]
mov dword [ebp - 0x820c], 0x4000
push eax
lea eax, [ebp - 0x8204]
push eax
push esi
push dword [ebp - 0x8208]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x53751e
lea eax, [ebp - 0x8204]
push eax
call fcn.00647fd1
pop ecx
test eax, eax
jne 0x5374d6
push dword [ebp - 0x8208]
call edi
push dword [ebp - 0x8210]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
inc ecx
test eax, eax
cmove esi, ecx
push ebx
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret

Function at 0x537551
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
push dword [ebp + 8]
xor esi, esi
call fcn.00567b83
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x537580
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
push edi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x544d84
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x17c
mov eax, 0x6a3544
call fcn.0056e23b
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x164], 0x11c
call fcn.004173bc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004173bc
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x544f53
mov eax, dword [ebp - 0x160]
sub eax, 4
je 0x544f0c
sub eax, ebx
je 0x544eab
sub eax, ebx
je 0x544e2f
sub eax, 4
je 0x544e06
push str.None
jmp 0x544f4b
cmp dword [ebp - 0x15c], 0
jne 0x544f53
lea ecx, [ebp - 0x2c]
cmp byte [ebp - 0x4a], bl
jne 0x544e25
push str.Microsoft_Windows_10
jmp 0x544f4e
push str.Microsoft_Windows_Server_2016
jmp 0x544f4e
mov eax, dword [ebp - 0x15c]
sub eax, 0
je 0x544e8f
sub eax, 1
je 0x544e73
sub eax, 1
je 0x544e60
sub eax, 1
jne 0x544f53
cmp byte [ebp - 0x4a], bl
jne 0x544f53
push str.Microsoft_Windows_8.1
jmp 0x544f4b
cmp byte [ebp - 0x4a], bl
jne 0x544f53
push str.Microsoft_Windows_8
jmp 0x544f4b
lea ecx, [ebp - 0x2c]
cmp byte [ebp - 0x4a], bl
jne 0x544e85
push str.Microsoft_Windows_7
jmp 0x544f4e
push str.Microsoft_Windows_Server_2008_R2
jmp 0x544f4e
lea ecx, [ebp - 0x2c]
cmp byte [ebp - 0x4a], bl
jne 0x544ea1
push str.Microsoft_Windows_Vista
jmp 0x544f4e
push str.Microsoft_Windows_Server_2008
jmp 0x544f4e
mov eax, dword [ebp - 0x15c]
sub eax, 0
je 0x544f05
sub eax, 1
je 0x544efe
sub eax, 1
jne 0x544f53
cmp byte [ebp - 0x4a], bl
jne 0x544eda
cmp word [ebp - 0x188], 9
jne 0x544eda
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x544f4b
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x544eef
push str.Microsoft_Windows_Server_2003
jmp 0x544f4b
push 0x59
call esi
test eax, eax
je 0x544f53
push str.Microsoft_Windows_Server_2003_R2
jmp 0x544f4b
push str.Microsoft_Windows_XP
jmp 0x544f4b
push str.Microsoft_Windows_2000
jmp 0x544f4b
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x544f2e
cmp eax, 0xa
je 0x544f27
cmp eax, 0x5a
jne 0x544f53
push str.Microsoft_Windows_Me
jmp 0x544f4b
push str.Microsoft_Windows_98
jmp 0x544f4b
cmp dword [ebp - 0x154], 2
jne 0x544f3e
push str.Microsoft_Windows_NT_4.0
jmp 0x544f4b
cmp dword [ebp - 0x154], ebx
jne 0x544f53
push str.Microsoft_Windows_95
lea ecx, [ebp - 0x2c]
call fcn.004179fb
movzx eax, word [ebp - 0x4e]
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push eax
movzx eax, word [ebp - 0x50]
cmovae esi, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x158]
lea eax, [ebp - 0x48]
push dword [ebp - 0x15c]
push dword [ebp - 0x160]
push eax
call fcn.00544fc6
pop ecx
push eax
push esi
push str._s__s__d._d_build__d__s__d._d
push edi
call fcn.0041ccda
lea esi, [edi + 4]
add esp, 0x28
cmp dword [esi + 0x14], 8
jb 0x544fa6
mov esi, dword [esi]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov eax, esi
call fcn.0056e1e5
ret
Function at 0x5452cc
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x6a3574
call fcn.0056e23b
mov esi, dword [ebp + 8]
call fcn.0052dbc7
call fcn.00428a2a
test eax, eax
je 0x5452f5
push esi
call fcn.00429345
pop ecx
jmp 0x5453b2
push 0x3c
xor edi, edi
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.00644240
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov dword [ebp - 4], edi
call fcn.00564e00
test eax, eax
je 0x54535a
cmp dword [0x796288], 8
mov eax, 0x796274
push 0x6fae68
cmovae eax, dword [0x796274]
push eax
lea eax, [ebp - 0x2c]
push 0x6fae90
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x545366
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0042810e
pop ecx
pop ecx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x68], 0x3c
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x64], 0x40
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], str.runas
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x48], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
xor eax, eax
call fcn.0056e1e5
ret