joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59063f00
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x59144107
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push 0x591959c4
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.59099c70
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 1
test eax, eax
je 0x59064043
mov esi, dword [esp + 0x24]
test esi, esi
je 0x59064043
mov eax, dword [eax + 4]
push eax
call fcn.59062710
add esp, 4
test eax, eax
je 0x59064043
mov ecx, dword [0x5914f850]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x38]
push ecx
push ecx
push edx
push eax
lea ecx, [esp + 0x34]
push str.SELECT__s_FROM__s_WHERE__s___1_ORDER_BY__s_DESC
push ecx
mov byte [esp + 0x2c], 2
call fcn.5909d390
mov eax, dword [esp + 0x3c]
add esp, 0x18
lea edx, [esp + 0x20]
mov ecx, 0x59194948
push 0
push edx
push 0xffffffffffffffff
push eax
push esi
mov dword [esp + 0x34], 0
call fcn.59002260
test eax, eax
jne 0x59064011
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push ecx
push edx
push 1
push eax
mov ecx, 0x59194948
call fcn.59002290
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, 0x59194948
call fcn.590022f0
cmp eax, 0x64
jne 0x59064000
mov edx, dword [esp + 0x20]
push 0
push edx
mov ecx, 0x59194948
call fcn.59002340
push eax
lea ecx, [esp + 8]
call fcn.5909a690
mov eax, dword [esp + 0x20]
mov ecx, 0x59194948
push eax
call fcn.590024a0
jmp 0x59064035
mov ecx, dword [0x59194a20]
test ecx, ecx
je 0x59064035
push eax
push str.MailMasterGetSentIdFromMailId_sqlite3_prepare16_v2__Failed__nSqlRet:__d_
push str.History
push 0xffffffffffffffff
push 0x591949b4
call fcn.59078030
add esp, 0x14
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 1
call fcn.5909a410
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.59099a10
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.5909a410
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x59065680
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x591442ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5914f850]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi + 0x28], eax
mov ecx, dword [0x5914f850]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], ecx
mov edx, dword [0x5914f850]
mov byte [esp + 0x14], 1
mov dword [esi + 0x30], edx
mov eax, dword [0x5914f850]
mov byte [esp + 0x14], 2
mov dword [esi + 0x34], eax
mov ecx, dword [0x5914f850]
mov byte [esp + 0x14], 3
mov dword [esi + 0x38], ecx
mov edx, dword [0x5914f850]
mov byte [esp + 0x14], 4
mov dword [esi + 0x3c], edx
mov eax, dword [0x5914f850]
mov byte [esp + 0x14], 5
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 6
call fcn.5909fd90
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 7
call fcn.5909fd90
lea ecx, [esi + 0x64]
mov byte [esp + 0x14], 8
call fcn.590a6450
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x14], 9
mov dword [esi + 0x18], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi], 0x5914a9d8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x74], 1
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x59065790
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5914436e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x5914a9d8
lea edi, [esi + 0x44]
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x24], 9
call fcn.5909fe00
lea ebx, [esi + 0x54]
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.5909fe00
lea ebp, [esi + 0x64]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.590a6470
mov ecx, ebp
mov byte [esp + 0x1c], 8
call fcn.590a6460
mov ecx, ebx
mov byte [esp + 0x1c], 7
call fcn.5909fda0
mov ecx, edi
mov byte [esp + 0x1c], 6
call fcn.5909fda0
lea ecx, [esi + 0x40]
mov byte [esp + 0x1c], 5
call fcn.5909a410
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 4
call fcn.5909a410
lea ecx, [esi + 0x38]
mov byte [esp + 0x1c], 3
call fcn.5909a410
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.5909a410
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
call fcn.5909a410
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 0
call fcn.5909a410
lea ecx, [esi + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.5909a410
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x59066e20
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
cmp dword [esi], 0
jne 0x59066e30
pop edi
xor eax, eax
pop esi
ret
cmp dword [esi + 0xc], 0xffffffff
je 0x59066e8f
mov eax, dword [esi + 8]
test eax, eax
je 0x59066e46
push eax
call fcn.5907bcc6
add esp, 4
mov eax, dword [esi]
push eax
call fcn.5907bdaf
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi + 8], edi
jne 0x59066e5d
pop edi
pop esi
ret
mov ecx, dword [esi]
xor eax, eax
mov edx, ecx
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0xc]
push eax
call fcn.5907d896
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
push ecx
push edx
push eax
call fcn.5907dc1b
add esp, 0x18
mov eax, dword [esi + 8]
pop edi
pop esi
ret
Function at 0x5906fbe0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
cmp dword [edx + 4], 1
jne 0x5906fd88
cmp word [edx + 0x18], 0x14
jae 0x5906fbfd
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x14]
lea ebx, [eax + 0x10]
mov eax, dword [eax + 0x10]
test eax, eax
mov dword [esp + 4], eax
jne 0x5906fc15
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov al, byte [ebx + 4]
add ebx, 4
test al, al
mov dword [esp + 0x14], ebx
je 0x5906fd8d
mov ecx, dword [0x59195e6c]
push ebp
mov ebp, dword [esp + 0x14]
xor eax, eax
push esi
push edi
test ecx, ecx
jbe 0x5906fc9f
mov esi, dword [0x59195e68]
mov edi, dword [edx + 8]
cmp edi, dword [esi]
jne 0x5906fc5f
mov edi, dword [edx + 0x10]
cmp edi, dword [esi + 8]
jne 0x5906fc5f
mov edi, dword [edx + 0x14]
cmp edi, dword [esi + 0xc]
jne 0x5906fc5f
mov edi, dword [edx + 0x1c]
cmp edi, dword [esi + 0x10]
je 0x5906fc6c
inc eax
add esi, 0x220
cmp eax, ecx
jb 0x5906fc40
jmp 0x5906fc9f
lea edi, [esi + 0x14]
push 0x103
lea ecx, [ebp + 0x2c]
push edi
push ecx
call fcn.5907b55d
push 0x103
lea edx, [ebp + 0x234]
push edi
push edx
call fcn.5907b55d
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x21c], eax
mov edx, dword [0x59195e5c]
xor eax, eax
test edx, edx
jbe 0x5906fd27
mov ebx, dword [0x59195e58]
lea esi, [ebp + 8]
mov ecx, 4
mov edi, ebx
xor ebp, ebp
repe cmpsd dword [esi], dword es:[edi]
jne 0x5906fce3
mov ecx, dword [esp + 0x18]
mov edi, dword [ebx + 0x10]
mov esi, dword [ecx + 0x10]
cmp esi, edi
jne 0x5906fce3
mov esi, dword [ecx + 0x14]
mov edi, dword [ebx + 0x14]
cmp esi, edi
jne 0x5906fce3
mov ecx, dword [ecx + 0x1c]
mov esi, dword [ebx + 0x18]
cmp ecx, esi
je 0x5906fcf4
mov ebp, dword [esp + 0x1c]
inc eax
add ebx, 0x230
cmp eax, edx
jb 0x5906fcb1
jmp 0x5906fd23
mov ebp, dword [esp + 0x1c]
lea edx, [ebx + 0x1c]
push 0x103
push edx
lea eax, [ebp + 0x2c]
push eax
call fcn.5907b55d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x224], eax
mov dword [ebp + 0x43c], 5
mov ebx, dword [esp + 0x20]
lea edi, [ebp + 0x234]
push edi
call fcn.5907c6fd
mov edx, dword [esp + 0x14]
xor cx, cx
mov cl, al
mov esi, 0x102
push edx
push ebx
sub esi, ecx
call fcn.5906fda0
add esp, 0xc
cmp ax, si
ja 0x5906fd54
mov esi, eax
push 0x59178d4c
call fcn.5907c6fd
push eax
push 0x59178d4c
push edi
call fcn.5907ef41
and esi, 0xffff
push esi
push ebx
push edi
call fcn.5907ef41
add esp, 0x1c
mov dword [ebp + 0x43c], 9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, 0xfffffffe
pop ebx
pop ecx
ret
Function at 0x59070850
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x220
push ebx
push esi
mov esi, dword [esp + 0x22c]
push edi
mov ax, word [esi + 0x18]
cmp ax, 8
jae 0x59070877
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x238]
add eax, 0xfffffffc
cmp ecx, 1
mov word [esi + 0x18], ax
jne 0x59070978
cmp ax, 5
jae 0x590708a4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov cx, word [edi + 4]
add eax, 0xfffffffe
cmp ax, 3
mov word [esi + 0x18], ax
jb 0x59070994
cmp cx, 0x48
jb 0x59070994
mov dx, word [edi + 6]
add eax, 0xfffffffe
and ecx, 0xffff
mov word [esi + 0x18], ax
and edx, 0xffff
and eax, 0xffff
lea esi, [ecx + edi - 0x40]
add eax, 8
lea ecx, [edx + ecx - 0x40]
cmp eax, ecx
jge 0x590708fd
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x220
ret
cmp byte [esi], 0
je 0x590709a8
mov eax, dword [esp + 0x23c]
mov ebx, dword [esp + 0x234]
test eax, eax
je 0x59070962
push edx
push esi
call fcn.5906fda0
mov edi, eax
push 0x5917e7cc
lea edx, [edi + edi]
push edx
push esi
call fcn.590704b0
add esp, 0x14
cmp eax, 0xffffffff
je 0x59070947
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
add esp, 0x220
ret
cmp edi, 0x103
jbe 0x59070954
mov edi, 0x103
push edi
lea eax, [ebx + 0x2c]
push esi
push eax
call fcn.5907b55d
add esp, 0xc
pop edi
mov dword [ebx + 0x43c], 0xa
pop esi
xor eax, eax
pop ebx
add esp, 0x220
ret
cmp ecx, 2
jne 0x590709fa
mov ecx, dword [esp + 0x234]
lea ebx, [ecx + 0x2c]
push ebx
call fcn.5907c6fd
add esp, 4
test eax, eax
jne 0x590709a1
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x590709b7
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x220
ret
mov ecx, 0x86
xor eax, eax
lea edi, [esp + 0x14]
push 0x103
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x24]
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call fcn.5907b55d
lea eax, [esp + 0x18]
push eax
call fcn.5906f520
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x220
ret
Function at 0x59090c60
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov ax, word [ebp]
push eax
call fcn.59090596
mov cx, word [ebp + 2]
mov word [esp + 0x10], ax
push ecx
call fcn.59090596
sub esp, 0xc
mov word [esp + 0x1e], ax
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x1c]
mov edx, esp
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [edx], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
call fcn.590906d0
mov ecx, dword [0x59198570]
mov edx, eax
mov eax, dword [0x5919857c]
add esp, 0xc
cmp eax, ecx
mov dword [esp + 0x20], edx
jle 0x59090d0a
mov ecx, dword [0x59198584]
mov byte [ecx + 0xc], 5
mov edx, dword [0x59198584]
mov esi, dword [edx + 0x10]
test esi, esi
je 0x59090cf7
mov ecx, dword [0x59198584]
lea eax, [esi + 4]
push eax
push ecx
call dword [esi]
mov esi, dword [esi + 0xc]
add esp, 8
test esi, esi
jne 0x59090ce0
mov edx, dword [0x59198584]
push edx
call fcn.59090b00
mov edx, dword [esp + 0x24]
add esp, 4
mov esi, dword [0x5919856c]
test esi, esi
jne 0x59090d2d
push str.gdb_me_..._n
push 0x59182320
call fcn.5912025f
add esp, 8
push 0xffffffffffffffff
call fcn.5907fcf6
mov edi, dword [0x5919857c]
mov eax, dword [esi + 0xb4]
mov ecx, dword [0x59198568]
inc edi
mov dword [0x5919856c], eax
mov dword [0x5919857c], edi
mov ebx, dword [ecx + edx*4]
mov ecx, 0x2e
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xa4], edx
mov edx, esi
mov byte [esi + 0x14], 2
mov dword [edx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
mov ecx, dword [ebp + 4]
push ecx
call fcn.59090584
inc eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dx, word [ebp + 0xe]
push edx
call fcn.59090596
xor ecx, ecx
mov word [esi + 0x4c], ax
cmp ebx, ecx
mov byte [esi + 0x58], 7
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ecx
je 0x59090db3
mov dword [ebx + 0xa0], esi
mov eax, dword [0x59198568]
mov edx, dword [esp + 0x20]
mov dword [eax + edx*4], esi
mov eax, dword [0x59198580]
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], ecx
cmp dword [0x59198584], ecx
jne 0x59090dde
mov dword [0x59198584], esi
mov eax, dword [0x59198580]
cmp eax, ecx
je 0x59090ded
mov dword [eax + 0xac], esi
mov dword [0x59198580], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x59092850
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x5909285d
xor eax, eax
pop esi
ret
mov al, byte [esi + 0x6c]
test al, al
jne 0x59092868
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x5909287e
push esi
call fcn.590928f0
add esp, 4
test eax, eax
jne 0x5909287e
pop esi
ret
lea eax, [esi + 0x64]
mov dword [esi + 0x68], 0
push eax
push 0
push esi
push 0x590928b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x60], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
ret
Function at 0x59092cd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push 0
push str._dev_urandom
call fcn.5907d46d
mov esi, eax
add esp, 8
test esi, esi
jle 0x59092d11
push 0xc
push 0x591994b8
push esi
call fcn.5907dc1b
push 0xc
push 0x591994c4
push esi
call fcn.5907dc1b
push esi
call fcn.5907d19d
add esp, 0x1c
pop esi
add esp, 8
ret
lea eax, [esp + 4]
push 0
push eax
call fcn.59093d70
mov ecx, dword [esp + 0x10]
push ecx
call fcn.59094260
add esp, 0xc
call fcn.590941c0
mov dword [0x591994b8], eax
call fcn.590941c0
mov dword [0x591994bc], eax
call fcn.590941c0
mov dword [0x591994c0], eax
call fcn.590941c0
mov dword [0x591994c4], eax
call fcn.590941c0
mov dword [0x591994c8], eax
call fcn.590941c0
mov dword [0x591994cc], eax
pop esi
add esp, 8
ret

Function at 0x59092d70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dx, word [esp + 0x14]
mov dword [esp], eax
mov ax, word [esp + 0x1c]
push esi
xor esi, esi
mov dword [esp + 8], ecx
mov word [esp + 0xc], dx
mov word [esp + 0xe], ax
xor ecx, ecx
xor edx, edx
xor eax, eax
mov dl, byte [ecx + 0x591994c4]
shl esi, 8
mov al, byte [esp + edx + 4]
xor edx, edx
mov dl, byte [ecx + 0x591994b8]
xor eax, edx
xor edx, edx
add eax, esi
mov esi, 0xff100f
div esi
inc ecx
cmp ecx, 0xb
mov esi, edx
jl 0x59092d9c
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x59093990
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0x5917f1cc
push 0x59182320
call fcn.5912025f
add esp, 0xc
push 1
call fcn.5907fcf6
nop
nop
Function at 0x59098ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x59098b1e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x59098b1e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x59098b23
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x59098b09
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x59098b33
test esi, esi
jne 0x59098b51
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x59098b4f
mov byte [eax + esi - 1], 0
jne 0x59098b58
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x5909e2b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x5909e300
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x5909e300
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x5909e305
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x5909e2eb
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x5909e312
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x590a7850
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x590a7891
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x590a7893
mov esi, edi
test esi, esi
je 0x590a7908
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x590a78fd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x590a78fd
cmp dword [esp + 0x1c], eax
jbe 0x590a78ce
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x590a78fd
cmp esi, edi
je 0x590a78ef
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x590a7908
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x590a7920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x590a7985
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x590a7985
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x590a7985
cmp dword [esp + 0x18], eax
jbe 0x590a796b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x590a7989
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x590a7a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x590a7abf
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x590a7abf
cmp dword [esp + 0xc], 3
jne 0x590a7abf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x590a7abf
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x590a7abf
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x590a7ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x590a7c14
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x590a7c14
cmp dword [esp + 0x10], 3
jne 0x590a7c14
mov edx, dword [esp + 0x18]
push edx
call fcn.5912c500
mov edi, eax
add esp, 4
test edi, edi
je 0x590a7c14
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x590a7c0b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.5912c529
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x590a7c20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x59145f7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x5914f84c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x590a7c8b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x590a7c8d
mov esi, edi
test esi, esi
je 0x590a7d57
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x590a7d4c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x590a7ccf
cmp eax, 2
je 0x590a7ccf
cmp eax, 6
je 0x590a7ccf
cmp eax, 7
jne 0x590a7d4c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.5912c500
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x590a7d32
lea ecx, [esp + 0x14]
call fcn.590952f0
cmp esi, dword [esp + 0x14]
je 0x590a7d27
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.5912c529
add esp, 4
jmp 0x590a7d69
call fcn.5912c529
add esp, 4
lea ecx, [esp + 0x10]
push 0x591949a0
call fcn.590952f0
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x590a7d57
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x590a7d69
push eax
lea ecx, [esp + 0x14]
call fcn.590952f0
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.59094660
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.59095090
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10