joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59071a70
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
cmp dword [esi], 0
jne 0x59071a80
pop edi
xor eax, eax
pop esi
ret
cmp dword [esi + 0xc], 0xffffffff
je 0x59071adf
mov eax, dword [esi + 8]
test eax, eax
je 0x59071a96
push eax
call fcn.59087a86
add esp, 4
mov eax, dword [esi]
push eax
call fcn.59087b6f
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi + 8], edi
jne 0x59071aad
pop edi
pop esi
ret
mov ecx, dword [esi]
xor eax, eax
mov edx, ecx
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0xc]
push eax
call fcn.590896b6
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
push ecx
push edx
push eax
call fcn.59089a3b
add esp, 0x18
mov eax, dword [esi + 8]
pop edi
pop esi
ret
Function at 0x5907b970
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
cmp dword [edx + 4], 1
jne 0x5907bb18
cmp word [edx + 0x18], 0x14
jae 0x5907b98d
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x14]
lea ebx, [eax + 0x10]
mov eax, dword [eax + 0x10]
test eax, eax
mov dword [esp + 4], eax
jne 0x5907b9a5
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov al, byte [ebx + 4]
add ebx, 4
test al, al
mov dword [esp + 0x14], ebx
je 0x5907bb1d
mov ecx, dword [0x591adc2c]
push ebp
mov ebp, dword [esp + 0x14]
xor eax, eax
push esi
push edi
test ecx, ecx
jbe 0x5907ba2f
mov esi, dword [0x591adc28]
mov edi, dword [edx + 8]
cmp edi, dword [esi]
jne 0x5907b9ef
mov edi, dword [edx + 0x10]
cmp edi, dword [esi + 8]
jne 0x5907b9ef
mov edi, dword [edx + 0x14]
cmp edi, dword [esi + 0xc]
jne 0x5907b9ef
mov edi, dword [edx + 0x1c]
cmp edi, dword [esi + 0x10]
je 0x5907b9fc
inc eax
add esi, 0x220
cmp eax, ecx
jb 0x5907b9d0
jmp 0x5907ba2f
lea edi, [esi + 0x14]
push 0x103
lea ecx, [ebp + 0x2c]
push edi
push ecx
call fcn.5908731d
push 0x103
lea edx, [ebp + 0x234]
push edi
push edx
call fcn.5908731d
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x21c], eax
mov edx, dword [0x591adc1c]
xor eax, eax
test edx, edx
jbe 0x5907bab7
mov ebx, dword [0x591adc18]
lea esi, [ebp + 8]
mov ecx, 4
mov edi, ebx
xor ebp, ebp
repe cmpsd dword [esi], dword es:[edi]
jne 0x5907ba73
mov ecx, dword [esp + 0x18]
mov edi, dword [ebx + 0x10]
mov esi, dword [ecx + 0x10]
cmp esi, edi
jne 0x5907ba73
mov esi, dword [ecx + 0x14]
mov edi, dword [ebx + 0x14]
cmp esi, edi
jne 0x5907ba73
mov ecx, dword [ecx + 0x1c]
mov esi, dword [ebx + 0x18]
cmp ecx, esi
je 0x5907ba84
mov ebp, dword [esp + 0x1c]
inc eax
add ebx, 0x230
cmp eax, edx
jb 0x5907ba41
jmp 0x5907bab3
mov ebp, dword [esp + 0x1c]
lea edx, [ebx + 0x1c]
push 0x103
push edx
lea eax, [ebp + 0x2c]
push eax
call fcn.5908731d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x224], eax
mov dword [ebp + 0x43c], 5
mov ebx, dword [esp + 0x20]
lea edi, [ebp + 0x234]
push edi
call fcn.5908850e
mov edx, dword [esp + 0x14]
xor cx, cx
mov cl, al
mov esi, 0x102
push edx
push ebx
sub esi, ecx
call fcn.5907bb30
add esp, 0xc
cmp ax, si
ja 0x5907bae4
mov esi, eax
push 0x591900ec
call fcn.5908850e
push eax
push 0x591900ec
push edi
call fcn.5908ad71
and esi, 0xffff
push esi
push ebx
push edi
call fcn.5908ad71
add esp, 0x1c
mov dword [ebp + 0x43c], 9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, 0xfffffffe
pop ebx
pop ecx
ret
Function at 0x5907c5e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x220
push ebx
push esi
mov esi, dword [esp + 0x22c]
push edi
mov ax, word [esi + 0x18]
cmp ax, 8
jae 0x5907c607
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x238]
add eax, 0xfffffffc
cmp ecx, 1
mov word [esi + 0x18], ax
jne 0x5907c708
cmp ax, 5
jae 0x5907c634
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov cx, word [edi + 4]
add eax, 0xfffffffe
cmp ax, 3
mov word [esi + 0x18], ax
jb 0x5907c724
cmp cx, 0x48
jb 0x5907c724
mov dx, word [edi + 6]
add eax, 0xfffffffe
and ecx, 0xffff
mov word [esi + 0x18], ax
and edx, 0xffff
and eax, 0xffff
lea esi, [ecx + edi - 0x40]
add eax, 8
lea ecx, [edx + ecx - 0x40]
cmp eax, ecx
jge 0x5907c68d
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x220
ret
cmp byte [esi], 0
je 0x5907c738
mov eax, dword [esp + 0x23c]
mov ebx, dword [esp + 0x234]
test eax, eax
je 0x5907c6f2
push edx
push esi
call fcn.5907bb30
mov edi, eax
push 0x59196374
lea edx, [edi + edi]
push edx
push esi
call fcn.5907c240
add esp, 0x14
cmp eax, 0xffffffff
je 0x5907c6d7
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
add esp, 0x220
ret
cmp edi, 0x103
jbe 0x5907c6e4
mov edi, 0x103
push edi
lea eax, [ebx + 0x2c]
push esi
push eax
call fcn.5908731d
add esp, 0xc
pop edi
mov dword [ebx + 0x43c], 0xa
pop esi
xor eax, eax
pop ebx
add esp, 0x220
ret
cmp ecx, 2
jne 0x5907c78a
mov ecx, dword [esp + 0x234]
lea ebx, [ecx + 0x2c]
push ebx
call fcn.5908850e
add esp, 4
test eax, eax
jne 0x5907c731
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x5907c747
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x220
ret
mov ecx, 0x86
xor eax, eax
lea edi, [esp + 0x14]
push 0x103
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x24]
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call fcn.5908731d
lea eax, [esp + 0x18]
push eax
call fcn.5907b2b0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x220
ret
Function at 0x5909ca90
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov ax, word [ebp]
push eax
call fcn.5909c3c6
mov cx, word [ebp + 2]
mov word [esp + 0x10], ax
push ecx
call fcn.5909c3c6
sub esp, 0xc
mov word [esp + 0x1e], ax
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x1c]
mov edx, esp
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [edx], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
call fcn.5909c500
mov ecx, dword [0x591b0330]
mov edx, eax
mov eax, dword [0x591b033c]
add esp, 0xc
cmp eax, ecx
mov dword [esp + 0x20], edx
jle 0x5909cb3a
mov ecx, dword [0x591b0344]
mov byte [ecx + 0xc], 5
mov edx, dword [0x591b0344]
mov esi, dword [edx + 0x10]
test esi, esi
je 0x5909cb27
mov ecx, dword [0x591b0344]
lea eax, [esi + 4]
push eax
push ecx
call dword [esi]
mov esi, dword [esi + 0xc]
add esp, 8
test esi, esi
jne 0x5909cb10
mov edx, dword [0x591b0344]
push edx
call fcn.5909c930
mov edx, dword [esp + 0x24]
add esp, 4
mov esi, dword [0x591b032c]
test esi, esi
jne 0x5909cb5d
push str.gdb_me_..._n
push 0x59199f20
call fcn.5913102f
add esp, 8
push 0xffffffffffffffff
call fcn.5908bb26
mov edi, dword [0x591b033c]
mov eax, dword [esi + 0xb4]
mov ecx, dword [0x591b0328]
inc edi
mov dword [0x591b032c], eax
mov dword [0x591b033c], edi
mov ebx, dword [ecx + edx*4]
mov ecx, 0x2e
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xa4], edx
mov edx, esi
mov byte [esi + 0x14], 2
mov dword [edx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
mov ecx, dword [ebp + 4]
push ecx
call fcn.5909c3b4
inc eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dx, word [ebp + 0xe]
push edx
call fcn.5909c3c6
xor ecx, ecx
mov word [esi + 0x4c], ax
cmp ebx, ecx
mov byte [esi + 0x58], 7
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ecx
je 0x5909cbe3
mov dword [ebx + 0xa0], esi
mov eax, dword [0x591b0328]
mov edx, dword [esp + 0x20]
mov dword [eax + edx*4], esi
mov eax, dword [0x591b0340]
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], ecx
cmp dword [0x591b0344], ecx
jne 0x5909cc0e
mov dword [0x591b0344], esi
mov eax, dword [0x591b0340]
cmp eax, ecx
je 0x5909cc1d
mov dword [eax + 0xac], esi
mov dword [0x591b0340], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x5909e680
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x5909e68d
xor eax, eax
pop esi
ret
mov al, byte [esi + 0x6c]
test al, al
jne 0x5909e698
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x5909e6ae
push esi
call fcn.5909e720
add esp, 4
test eax, eax
jne 0x5909e6ae
pop esi
ret
lea eax, [esi + 0x64]
mov dword [esi + 0x68], 0
push eax
push 0
push esi
push 0x5909e6e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x60], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
ret
Function at 0x5909eb00
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push 0
push str._dev_urandom
call fcn.5908928d
mov esi, eax
add esp, 8
test esi, esi
jle 0x5909eb41
push 0xc
push 0x591b1278
push esi
call fcn.59089a3b
push 0xc
push 0x591b1284
push esi
call fcn.59089a3b
push esi
call fcn.59088fbd
add esp, 0x1c
pop esi
add esp, 8
ret
lea eax, [esp + 4]
push 0
push eax
call fcn.5909fba0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.590a0090
add esp, 0xc
call fcn.5909fff0
mov dword [0x591b1278], eax
call fcn.5909fff0
mov dword [0x591b127c], eax
call fcn.5909fff0
mov dword [0x591b1280], eax
call fcn.5909fff0
mov dword [0x591b1284], eax
call fcn.5909fff0
mov dword [0x591b1288], eax
call fcn.5909fff0
mov dword [0x591b128c], eax
pop esi
add esp, 8
ret

Function at 0x5909eba0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dx, word [esp + 0x14]
mov dword [esp], eax
mov ax, word [esp + 0x1c]
push esi
xor esi, esi
mov dword [esp + 8], ecx
mov word [esp + 0xc], dx
mov word [esp + 0xe], ax
xor ecx, ecx
xor edx, edx
xor eax, eax
mov dl, byte [ecx + 0x591b1284]
shl esi, 8
mov al, byte [esp + edx + 4]
xor edx, edx
mov dl, byte [ecx + 0x591b1278]
xor eax, edx
xor edx, edx
add eax, esi
mov esi, 0xff100f
div esi
inc ecx
cmp ecx, 0xb
mov esi, edx
jl 0x5909ebcc
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x5909f7c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0x59196dd4
push 0x59199f20
call fcn.5913102f
add esp, 0xc
push 1
call fcn.5908bb26
nop
nop
Function at 0x590a4900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x590a494e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x590a494e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x590a4953
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x590a4939
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x590a4963
test esi, esi
jne 0x590a4981
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x590a497f
mov byte [eax + esi - 1], 0
jne 0x590a4988
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x590aa0e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x590aa130
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x590aa130
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x590aa135
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x590aa11b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x590aa142
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x590b4e40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x590b4e81
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x590b4e83
mov esi, edi
test esi, esi
je 0x590b4ef8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x590b4eed
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x590b4eed
cmp dword [esp + 0x1c], eax
jbe 0x590b4ebe
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x590b4eed
cmp esi, edi
je 0x590b4edf
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x590b4ef8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x590b4f10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x590b4f75
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x590b4f75
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x590b4f75
cmp dword [esp + 0x18], eax
jbe 0x590b4f5b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x590b4f79
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x590b5050
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
je 0x590b50af
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x590b50af
cmp dword [esp + 0xc], 3
jne 0x590b50af
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x590b50af
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x590b50af
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x590b5190
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x590b5204
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x590b5204
cmp dword [esp + 0x10], 3
jne 0x590b5204
mov edx, dword [esp + 0x18]
push edx
call fcn.5913d2d0
mov edi, eax
add esp, 4
test edi, edi
je 0x590b5204
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x590b51fb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.5913d2f9
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x590b5210
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5915847f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x5916287c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x590b527b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x590b527d
mov esi, edi
test esi, esi
je 0x590b5347
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x590b533c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x590b52bf
cmp eax, 2
je 0x590b52bf
cmp eax, 6
je 0x590b52bf
cmp eax, 7
jne 0x590b533c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.5913d2d0
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x590b5322
lea ecx, [esp + 0x14]
call fcn.590a1120
cmp esi, dword [esp + 0x14]
je 0x590b5317
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.5913d2f9
add esp, 4
jmp 0x590b5359
call fcn.5913d2f9
add esp, 4
lea ecx, [esp + 0x10]
push 0x591ac690
call fcn.590a1120
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x590b5347
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x590b5359
push eax
lea ecx, [esp + 0x14]
call fcn.590a1120
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.590a0490
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.590a0ec0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x590b5e00
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [ecx]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x590b5e48
lea edx, [esp + 0x10]
or eax, 0x20006
push edx
lea edx, [esp + 0x1c]
push edx
push 0
push eax
push 0
push 0
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x590b5e4a
mov esi, edi
test esi, esi
je 0x590b5e8a
mov ecx, dword [esp + 0x14]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x590b5e7f
cmp esi, edi
je 0x590b5e74
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
pop ecx
ret 0xc
cmp esi, edi
je 0x590b5e8a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x590b5f70
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x590b5f9c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push 3
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x590b5f9c
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x590b6050
Capabilities:
Set registry value

Disassembly:
mov edx, dword [ecx]
test edx, edx
je 0x590b6086
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
test eax, eax
jne 0x590b6086
mov eax, 1
ret 8
xor eax, eax
ret 8
Function at 0x590b60c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59158548
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x590b6116
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x590b6119
mov esi, dword [ebp + 8]
test esi, esi
je 0x590b6203
call fcn.590bb210
test eax, eax
je 0x590b619e
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x590b6167
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
inc ebx
lea eax, [ebx + ebx]
add eax, 3
and al, 0xfc
call fcn.5908a310
mov edi, esp
test edi, edi
je 0x590b6167
mov eax, dword [ebp + 0x10]
push ebx
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x590b6169
xor edi, edi
mov ebx, dword [ebp + 0x18]
push ebx
call fcn.5908850e
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x590b61f7
cmp esi, dword [ebp + 8]
je 0x590b6197
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x590b6205
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x18]
push edx
call fcn.590a0760
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [ebp + 0x10]
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x590b61e8
cmp esi, dword [ebp + 8]
je 0x590b61d2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.590a0ec0
mov eax, 1
jmp 0x590b6205
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.590a0ec0
cmp esi, dword [ebp + 8]
je 0x590b6203
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x590b6b20
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x14]
push esi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
call fcn.590aaf50
cmp ebp, ebx
je 0x590b6bf8
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push ebx
lea ecx, [esp + 0x28]
push eax
push ecx
push ebx
push ebx
push ebx
push ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x590b6bf8
cmp dword [esp + 0x10], ebx
jbe 0x590b6bf8
mov eax, dword [esp + 0xc]
cmp eax, 0x104
jae 0x590b6b86
mov eax, 0x104
mov dword [esp + 0xc], eax
inc eax
push eax
call fcn.5913d2d0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x590b6bf8
cmp dword [esp + 0x10], ebx
jbe 0x590b6be1
push edi
mov edx, dword [esp + 0x10]
xor eax, eax
mov edi, esi
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
inc eax
push eax
push esi
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x590b6bd7
mov ecx, dword [esp + 0x1c]
push esi
mov edx, dword [ecx + 4]
push edx
call fcn.590ab3f0
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jb 0x590b6b9d
pop edi
push esi
call fcn.5913d2f9
add esp, 4
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4