joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d8f34
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5d9013
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.005d90b8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5d8ff0
xor eax, eax
push ebp
push 0x5d8fe9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5d8fd3
inc esi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 4]
lea eax, [ebp - 4]
call fcn.00406f8c
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005d92e8
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
call sub.kernel32.dll_MoveFileW
inc dword [ebp - 0x10]
dec esi
jne 0x5d8f8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8ff0
mov eax, dword [ebp - 0xc]
call fcn.00404490
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d901a
lea eax, [ebp - 0x14]
call fcn.00406b98
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x5dc020
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
test dl, dl
je 0x5dc03f
add esp, 0xfffffff0
call fcn.00404974
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5dc0e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, esi
call fcn.005dc198
mov dword [esi + 0x18], 0xf003f
mov byte [esi + 0xc], 1
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x110], 5
jne 0x5dc095
call fcn.00516e3c
test al, al
jne 0x5dc0c3
cmp dword [ebp - 0x110], 5
ja 0x5dc0c3
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.00514484
mov eax, dword [ebp - 0x118]
mov edx, 0x5dc114
call fcn.00470760
test al, al
jne 0x5dc0c3
xor eax, eax
jmp 0x5dc0c5
mov al, 1
mov byte [0x6dc76c], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc0ea
lea eax, [ebp - 0x118]
call fcn.00406b98
ret
Function at 0x5dc5d8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5dc7e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406bfc
mov eax, dword [ebp - 4]
call fcn.005dbec4
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x5dc62a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004072dc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.005dd45c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x5dc6ff
xor eax, eax
push ebp
push 0x5dc6f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.005dc1fc
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.005dc850
test al, al
je 0x5dc6d6
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406ce4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x5dc6d6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x5dc6d0
mov eax, dword [ebp - 8]
call fcn.00406c34
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00406d64
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.005dc5d8
dec ebx
cmp ebx, 0xffffffff
jne 0x5dc689
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc6ff
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.005dc1fc
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [0x6dc76c], 0
je 0x5dc7a3
cmp dword [0x6dc774], 0
je 0x5dc746
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.005dc1e8
push eax
call dword [0x6dc774]
test eax, eax
sete bl
jmp 0x5dc7c3
cmp dword [0x6dc774], 0
jne 0x5dc7a3
push 0x5dc7f4
push 0x5dc814
call sub.kernel32.dll_LoadLibraryW
push eax
call fcn.0040a178
mov dword [0x6dc774], eax
cmp dword [0x6dc774], 0
je 0x5dc7a3
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.005dc1e8
push eax
call dword [0x6dc774]
test eax, eax
sete bl
jmp 0x5dc7c3
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.005dc1e8
push eax
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc7ed
lea eax, [ebp - 0x3c]
call fcn.00406b98
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x5dc968
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5dca9a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x5dca7c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406bfc
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5dc9f4
inc ebx
xor esi, esi
cmp dword [ebp - 4], 0
jne 0x5dc9cb
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
jmp 0x5dc9f0
push dword [ebp - 4]
push 0x5dcab4
lea ecx, [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040705c
inc esi
dec ebx
jne 0x5dc9b6
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x5dca0d
lea eax, [ebp - 4]
mov edx, 0x5dcab4
call fcn.00406f0c
lea eax, [ebp - 4]
mov edx, 0x5dcab4
call fcn.00406f0c
mov esi, 7
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5dca2b
sub ebx, 4
mov ebx, dword [ebx]
mov eax, ebx
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
push esi
push 0
mov eax, dword [ebp - 0xc]
call fcn.00406c34
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x5dca7c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x693d5c]
mov dl, 1
mov eax, dword [0x5dbd88]
call fcn.00478ef8
call fcn.00405328
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dcaa1
lea eax, [ebp - 0x14]
call fcn.00406b98
lea eax, [ebp - 4]
call fcn.00406b98
ret
Function at 0x5dcaec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5dcc00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, esi
xor edx, edx
call fcn.00406ba8
mov dword [ebp - 0x10], edi
mov eax, edi
sar eax, 1
jns 0x5dcb32
adc eax, 0
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5dcab8]
call fcn.004084ec
add esp, 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, ebx
call fcn.00406c34
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5dcbbc
cmp dword [ebp - 0xc], 7
jne 0x5dcbbc
xor ebx, ebx
jmp 0x5dcbae
mov eax, dword [ebp - 4]
cmp word [eax + ebx*2], 0
je 0x5dcba1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
movzx edx, word [edx + ebx*2]
call fcn.00406d24
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00406f0c
jmp 0x5dcbad
mov eax, esi
mov edx, 0x5dcc1c
call fcn.00406f0c
inc ebx
mov eax, edi
sar eax, 1
jns 0x5dcbb7
adc eax, 0
dec eax
cmp ebx, eax
jl 0x5dcb7c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5dcab8]
call fcn.004084ec
add esp, 4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dcc07
lea eax, [ebp - 0x14]
call fcn.00406b98
lea eax, [ebp - 4]
mov edx, dword [0x5dcab8]
call fcn.0040860c
ret
Function at 0x5dce84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5dd037
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor ebx, ebx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406bfc
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x5dcfe0
cmp dword [ebp - 0x14], 4
jne 0x5dcf59
mov dword [ebp - 0x1c], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x5dcf3a
mov eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov bl, 1
jmp 0x5dcffa
lea edx, [ebp - 0x2c]
mov eax, edi
call fcn.004712b0
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 0x5dd058
call fcn.00406f8c
jmp 0x5dcffa
cmp dword [ebp - 0x14], 0xb
jne 0x5dcfbf
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x5dcfa3
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov bl, 1
jmp 0x5dcffa
lea edx, [ebp - 0x30]
mov eax, edi
call fcn.004712b0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x5dd088
call fcn.00406f8c
jmp 0x5dcffa
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.004714bc
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 4]
mov edx, 0x5dd0b8
call fcn.00406f8c
jmp 0x5dcffa
lea edx, [ebp - 0x38]
mov eax, edi
call fcn.004712b0
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, 0x5dd0e0
call fcn.00406f8c
test bl, bl
jne 0x5dd014
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406f8c
mov eax, dword [ebp - 0x3c]
call fcn.005dbe98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dd03e
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b98
ret
Function at 0x5dd190
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.005dbedc
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00406c34
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x5dd1ef
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x693d5c]
mov dl, 1
mov eax, dword [0x5dbd88]
call fcn.00478ef8
call fcn.00405328
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5dd1f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00406c34
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x5dd250
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x694518]
mov dl, 1
mov eax, dword [0x5dbd88]
call fcn.00478ef8
call fcn.00405328
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.005dbf0c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5dd2a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5dd3ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
call fcn.005dbedc
mov dword [ebp - 0xc], eax
mov eax, esi
xor edx, edx
call fcn.00406ba8
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x5dd2f5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x5dd2f8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5dd26c]
call fcn.004084ec
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00403bd8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00406c34
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
jne 0x5dd34e
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406d64
mov edx, dword [esi]
mov eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x5dd361
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x802
jle 0x5dd3b6
mov eax, edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x5dd379
sub esi, 4
mov esi, dword [esi]
push 0x5dd408
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004712b0
push dword [ebp - 0x1c]
push 0x5dd448
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.004712b0
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040705c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.005dbe70
mov eax, dword [ebp - 0xc]
call fcn.005dbf0c
mov edx, dword [ebp + 0xc]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dd3f3
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00406ba0
lea eax, [ebp - 4]
mov edx, dword [0x5dd26c]
call fcn.0040860c
ret
Function at 0x5dd6a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5dd7bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.005dc1fc
xor eax, eax
push ebp
push 0x5dd796
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005dc850
test al, al
je 0x5dd77a
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.005dd584
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406ce4
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x5dd77a
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
test eax, eax
jne 0x5dd776
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00406d64
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.005dd584
pop ecx
inc edi
dec ebx
jne 0x5dd72b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dd79d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.005dc1fc
ret
Function at 0x5dd7cc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5dda0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.005dc1fc
xor eax, eax
push ebp
push 0x5dd9e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005dc850
test al, al
je 0x5dd9c7
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406ce4
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x5dd9c7
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x5dd9bb
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00406d64
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005dd45c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x5dd9bb
xor eax, eax
push ebp
push 0x5dd9b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.005dc1fc
xor eax, eax
push ebp
push 0x5dd996
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00406d64
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005dc200
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00406d64
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005dd45c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x5dd973
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.005dd6a4
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.005dd7cc
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dd97a
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x5dd857
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dd9ea
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.005dc1fc
ret
Function at 0x5e38ec
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor edx, edx
push ebp
push 0x5e3a9a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, 0x11c
call fcn.00403bd8
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
xor ecx, ecx
mov edx, 0x24
call fcn.00403bd8
push 0x5e3ab0
push 0x5e3ad8
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040a178
test eax, eax
je 0x5e396b
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x5e3977
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [ebp - 0x110], 2
jne 0x5e3a90
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x5e3999
mov dword [ebp - 4], 2
cmp dword [ebp - 0x11c], 5
jne 0x5e39b7
cmp dword [ebp - 0x118], 0
jne 0x5e39b7
mov dword [ebp - 4], 3
jmp 0x5e3a90
cmp dword [ebp - 0x11c], 5
jne 0x5e39d5
cmp dword [ebp - 0x118], 1
jne 0x5e39d5
mov dword [ebp - 4], 4
jmp 0x5e3a90
cmp dword [ebp - 0x11c], 5
jne 0x5e3a0f
cmp dword [ebp - 0x118], 2
jne 0x5e3a0f
cmp byte [ebp - 6], 1
jne 0x5e3a03
cmp word [ebp - 0x144], 9
jne 0x5e3a03
mov dword [ebp - 4], 4
jmp 0x5e3a90
mov dword [ebp - 4], 5
jmp 0x5e3a90
cmp dword [ebp - 0x11c], 6
jne 0x5e3a2a
cmp dword [ebp - 0x118], 0
jne 0x5e3a2a
mov dword [ebp - 4], 6
jmp 0x5e3a90
cmp dword [ebp - 0x11c], 6
jne 0x5e3a45
cmp dword [ebp - 0x118], 1
jne 0x5e3a45
mov dword [ebp - 4], 7
jmp 0x5e3a90
cmp dword [ebp - 0x11c], 6
jne 0x5e3a67
mov eax, dword [ebp - 0x118]
cmp eax, 2
je 0x5e3a5e
cmp eax, 3
jne 0x5e3a67
mov dword [ebp - 4], 8
jmp 0x5e3a90
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x5e3a84
cmp dword [ebp - 0x118], 4
jne 0x5e3a84
mov dword [ebp - 4], 0xa
jmp 0x5e3a90
cmp eax, 0xa
jne 0x5e3a90
mov dword [ebp - 4], 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5e3aa4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e8718
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e87b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0x5e87cc
call fcn.005e7d80
mov eax, ebx
xor edx, edx
call fcn.00406ba8
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x5e877c
mov eax, ebx
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00406db8
mov ecx, dword [ebx]
lea eax, [ebp - 0x210]
mov edx, 0x5e87f8
call fcn.00406f8c
mov eax, dword [ebp - 0x210]
xor edx, edx
call fcn.005e7d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e87bb
lea eax, [ebp - 0x210]
call fcn.00406b98
ret

Function at 0x611078
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
xor ecx, ecx
push ebp
push 0x61119e
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x61111b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 8]
push ecx
push edx
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
cmp ebx, 0x20
ja 0x611111
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.00405e24
push dword [ebp - 0xc]
push 0x6111bc
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov ecx, 0
call fcn.00405e24
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040604c
push 1
lea eax, [ebp - 4]
call fcn.00406270
push eax
call sub.kernel32.dll_WinExec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61117b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6111a5
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405b60
lea eax, [ebp - 4]
call fcn.00405b3c
ret