joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a416b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x101a41b5
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x101a415c
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x101a416b
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x105a9e0e
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x101a41bc
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1018b032
cmp eax, dword [ebp + 0xc]
pop eax
je 0x101a425b
add edi, 4
add eax, 2
dec ecx
jne 0x101a41a1
call 0x101a4208
loope 0x101a41fe
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x101a4258
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x101a4269
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x101a421c
cmp eax, ecx
ja 0x101a421c
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x101a42a6
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x101a429c
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1018b511
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401600
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x84a134], 0x400
push esi
push edi
jne 0x401645
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 4]
push edx
mov word [ebp - 4], ax
mov word [ebp - 2], cx
mov eax, dword [ebp - 4]
push eax
push ecx
push str.kayed
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
lea eax, [ebp - 0x24]
call fcn.00401710
lea esi, [ebp - 0x24]
call fcn.00401730
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebx, dword [ebp - 4]
xor esi, esi
call edi
cmp esi, 0x2af2a3
jle 0x401663
cmp ebx, 0x78abdb45
jne 0x40166c
inc esi
cmp esi, 0x1c5d
jl 0x401651
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
lea ebx, [ebx]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, 0x206d47
jg 0x40169d
inc esi
cmp esi, 0x4f6a4
jl 0x401680
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
push 0
call edi
cmp esi, 0x2b259d
jle 0x4016bc
cmp ebx, 0x785074d5
jne 0x4016c5
inc esi
cmp esi, 0x11915
jl 0x4016a8
mov ecx, dword [0x42c6e4]
mov dword [0x84a134], ecx
call fcn.00401370
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov edi, 0x3078f
pop ebx
cmp dword [0x84a134], 0x51f
jne 0x4016f4
push 0
push 0
call esi
sub edi, 1
jne 0x4016e2
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406302
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42bb70]
jne 0x40630c
repz ret
jmp fcn.0040839c
Function at 0x407829
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402e93
and dword [ebp - 4], 0
cmp dword [0x42d0e8], 0
mov ebx, eax
jne 0x4078da
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40798b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40798b
push eax
call fcn.00402e21
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d0e8], eax
call esi
push eax
call fcn.00402e21
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42d0ec], eax
call esi
push eax
call fcn.00402e21
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42d0f0], eax
call esi
push eax
call fcn.00402e21
pop ecx
mov dword [0x42d0f8], eax
test eax, eax
je 0x4078da
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e21
pop ecx
mov dword [0x42d0f4], eax
mov eax, dword [0x42d0f4]
cmp eax, ebx
je 0x407932
cmp dword [0x42d0f8], ebx
je 0x407932
push eax
call fcn.00402e9c
push dword [0x42d0f8]
mov esi, eax
call fcn.00402e9c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407932
test edi, edi
je 0x407932
call esi
test eax, eax
je 0x407929
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407929
test byte [ebp - 0xc], 1
jne 0x407932
or dword [ebp + 0x10], 0x200000
jmp 0x40796b
mov eax, dword [0x42d0ec]
cmp eax, ebx
je 0x40796b
push eax
call fcn.00402e9c
pop ecx
test eax, eax
je 0x40796b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40796b
mov eax, dword [0x42d0f0]
cmp eax, ebx
je 0x40796b
push eax
call fcn.00402e9c
pop ecx
test eax, eax
je 0x40796b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d0e8]
call fcn.00402e9c
pop ecx
test eax, eax
je 0x40798b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40798d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5d3f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5e89fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x5d4002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.005d7dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x5d4002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.005cf6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.005d820b
push 0x10
call fcn.005d81d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x5d3fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.005c41c0
jmp 0x5d3fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.005d3b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x5d3ff0
mov ecx, edi
call fcn.005c42c0
push edi
call fcn.005d81c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5d4021
inc ebx
cmp ebx, 0x20
jb 0x5d3f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5d71b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005d7140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005d7140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005d7140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005d7140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5d7bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5d7c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5e987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5d7c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5d7c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10032550
Capabilities:
Encode data using xor

Disassembly:
mov edx, es
test eax, 0x26784ed6
in al, 0xe6
pop edx
xchg ebx, eax
movsd dword es:[edi], dword [esi]
nop
pop ebp
invalid

Function at 0x109b6b74
Capabilities:
Encode data using xor

Disassembly:
jmp 0x109b6b7e
pushal
call 0x109b6b84
pop ebp
sub ebp, 0x10
sub ebp, 0x9b6b74
mov al, byte [esp + 0x28]
cmp al, 1
je 0x109b6ba8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x109b6bb1
mov eax, 0x9b6b74
add eax, ebp
add eax, 0x63
mov ecx, 0x592
mov edx, 0xc44eebd9
xor byte [eax], dl
inc eax
dec ecx
jne 0x109b6bc8
jmp 0x109b6bdb
push edx
adc al, 0x52
push eax
in eax, 0xd9
fstpnce st(1), st(0)
pop eax
sbb byte [ecx], ah
fstpnce st(1), st(0)
fstpnce st(2), st(0)
adc al, 0x61
rcr ecx, 1
fstpnce st(1), st(0)
arpl cx, si
fstpnce st(1), st(0)
fldcw word [esi]
cmp ebx, edx
adc dword [edx + 0x58], edx
aad 0xd9
fstpnce st(1), st(0)
ficomp dword [ecx + ecx*4]
mov dword [ecx - 0x26397dd7], esi
mov cl, 0x58
salc
movsd dword es:[edi], dword [esi]
fstpnce st(0), st(0)
cmc
std
mov cl, 0x6d
aad 0xb3
leave
xor esp, ebx
fstpnce st(1), st(0)
fnstenv [eax]
int1
fstpnce st(1), st(0)
invalid

Function at 0x438c9d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
mov edx, 0xa015e042
call fcn.00438ccc
mov ebx, edx
xor dword [edi], eax
sub ebx, 0xd6d030d4
and edx, ebx
add ebx, 1
inc edi
mov edx, edx
add edx, ebx
inc edx
cmp edi, ecx
jne fcn.00438c9d
inc edx
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x5c00cb66
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5c059aa4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x98
lea eax, [ebp - 0x9c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExA]
test eax, eax
je 0x5c00cbe1
cmp dword [ebp - 0x90], 2
jne 0x5c00cbe1
cmp dword [ebp - 0x9c], 5
jne 0x5c00cbe8
cmp dword [ebp - 0x98], 0
jne 0x5c00cbe8
and dword [0x5c05b044], 0
cmp word [ebp - 0xc], 0
je 0x5c00cbe8
mov dword [0x5c05b5ec], 1
jmp 0x5c00cbe8
and dword [0x5c05b044], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.5c04f7b0
leave
ret

Function at 0x5c00cbf4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x2000000
push 0
push 0x5c00255c
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c00cc6a
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x5c002bd4
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x5c00cc61
cmp dword [ebp - 0xc], 4
jne 0x5c00cc61
cmp dword [ebp - 0x10], eax
je 0x5c00cc61
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
and dword [0x5c05b040], 0
xor eax, eax
leave
ret
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [0x5c05b040]
test eax, eax
jns 0x5c00cc80
push 3
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_IsProcessorFeaturePresent]
mov dword [0x5c05b040], eax
leave
ret
Function at 0x5c00cc82
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
push edi
push 4
xor edi, edi
pop esi
mov dword [ebp - 8], esi
sub eax, edi
je 0x5c00cd65
sub eax, 1
jne 0x5c00cd8f
mov ecx, 0x5c059a50
call fcn.5c00cfc0
call fcn.5c00ce96
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_DisableThreadLibraryCalls]
call fcn.5c00cb66
mov dword [0x5c05b44c], 0x50
call fcn.5c00cbf4
test eax, eax
mov eax, dword [0x5c05b44c]
je 0x5c00cce4
add eax, eax
mov dword [0x5c05b44c], eax
imul eax, eax, 0x28
mov dword [0x5c05b448], eax
lea eax, [ebp - 4]
push eax
push 0x2000000
push edi
push 0x5c00255c
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c00cd54
lea eax, [ebp - 8]
push eax
push 0x5c05b454
lea eax, [ebp - 0xc]
push eax
push edi
push 0x5c002be0
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x5c00cd3f
cmp dword [ebp - 0xc], esi
jne 0x5c00cd3f
mov eax, dword [0x5c05b454]
cmp eax, esi
jb 0x5c00cd3f
cmp eax, 0x80
jbe 0x5c00cd49
mov dword [0x5c05b454], 0x18
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x5c00cd5e
mov dword [0x5c05b454], 0x18
call fcn.5c00cd98
jmp 0x5c00cd8f
mov esi, dword [0x5c059a5c]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call dword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventUnregister]
mov eax, dword [0x5c05b450]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi], edi
test eax, eax
je 0x5c00cd8f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0xc
Function at 0x5c00cd98
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c059aa4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
mov esi, 0x104
lea ecx, [ebp - 0x108]
push esi
push ecx
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c00cdd5
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
js 0x5c00cdf4
cmp byte [ebp + eax - 0x108], 0x5c
je 0x5c00cdf4
sub eax, 1
jns 0x5c00cde5
lea ecx, [ebp - 0x20c]
mov edx, ecx
sub eax, edx
lea edx, [ebp - 0x107]
add edx, eax
lea eax, [esi + 0x7ffffefa]
test eax, eax
je 0x5c00ce1f
mov al, byte [edx + ecx]
test al, al
je 0x5c00ce1f
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x5c00ce06
test esi, esi
jne 0x5c00ce24
dec ecx
push ebx
lea eax, [ebp - 0x210]
mov byte [ecx], bl
push eax
push ebx
push 0x2000000
push ebx
push ebx
push ebx
push 0x5c002bec
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
test eax, eax
jne 0x5c00ce88
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c00ce54
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x5c002c20
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.5c04f7b0
leave
ret

Function at 0x5c0153c2
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x5c05b5f4]
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
test eax, eax
je 0x5c0153fe
push eax
push 1
lea eax, [ebp - 4]
push 4
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
push dword [0x5c05b5f4]
lea eax, [ebp - 8]
push 1
push 4
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x20
leave
ret

Function at 0x5c015400
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x5c05b5f4]
test eax, eax
je 0x5c015417
push eax
push edx
push 1
push ecx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
ret
Function at 0x5c0163ea
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov esi, edx
mov ebx, ecx
mov dword [eax], edi
mov ecx, 0x5c002884
mov edx, edi
mov eax, dword [ebx + edx*4]
cmp eax, dword [ecx + edx*4]
jne 0x5c016420
inc edx
cmp edx, 4
jne 0x5c016407
mov dword [esi], 0x5c05b458
jmp 0x5c0164d4
push 4
mov ecx, edi
pop edx
mov eax, dword [ebx + ecx*4]
mov edi, 0x5c002874
push 0
cmp eax, dword [edi + ecx*4]
pop edi
jne 0x5c016445
inc ecx
cmp ecx, edx
jne 0x5c016425
mov dword [esi], 0x5c05b460
jmp 0x5c0164d4
mov ecx, edi
mov eax, dword [ebx + ecx*4]
mov edi, 0x5c002854
push 0
cmp eax, dword [edi + ecx*4]
pop edi
jne 0x5c016464
inc ecx
cmp ecx, edx
jne 0x5c016447
mov dword [esi], 0x5c05b468
jmp 0x5c0164d4
mov ecx, edi
mov eax, dword [ebx + ecx*4]
mov edi, 0x5c0028c4
push 0
cmp eax, dword [edi + ecx*4]
pop edi
jne 0x5c01647d
inc ecx
cmp ecx, edx
jne 0x5c016466
jmp 0x5c016498
mov ecx, edi
mov eax, dword [ebx + ecx*4]
mov edi, 0x5c0028b4
push 0
cmp eax, dword [edi + ecx*4]
pop edi
jne 0x5c01659e
inc ecx
cmp ecx, edx
jne 0x5c01647f
push edi
push edi
push 0x5c002efc
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
test eax, eax
je 0x5c01659e
push 0x5c002f14
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5c01659c
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x5c05d150]
call edi
xor edi, edi
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push 0x5c002590
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c016598
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x5c002f28
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x5c01658f
cmp dword [ebp - 0xc], 4
jne 0x5c01658f
cmp dword [ebp - 4], 4
jne 0x5c01658f
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x5c01658f
cmp eax, 2
jbe 0x5c016589
cmp eax, 3
je 0x5c016581
jbe 0x5c01658f
cmp eax, 5
jbe 0x5c01654d
cmp eax, 6
jne 0x5c01658f
mov dword [esi], 0x5c05b468
jmp 0x5c01658f
push edi
push edi
push 0x5c002efc
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
test eax, eax
je 0x5c01659e
push 0x5c002f14
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5c01659c
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x5c05d150]
call edi
jmp 0x5c01658f
mov dword [esi], 0x5c05b460
jmp 0x5c01658f
mov dword [esi], 0x5c05b458
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
jmp 0x5c0165a5
xor edi, edi
mov eax, 0x80004002
mov dword [esi], edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x5c0167b3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
lea ecx, [edi + 0xf3c]
call fcn.5c03d58b
test eax, eax
jne 0x5c01692c
push ebx
push 0xed0
xor ebx, ebx
push ebx
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov ecx, edi
mov word [edi + 0xed0], ax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.5c01666f
test eax, eax
jne 0x5c01692b
mov eax, dword [ebp + 0x10]
mov edx, 0x1c4
or dword [edi + 0xf14], 0xffffffff
mov ecx, edi
mov dword [edi + 0xf54], edi
mov dword [edi + 0x12a0], 0x12a4
mov dword [edi + 0xeb4], eax
call fcn.5c017d66
mov eax, dword [ebp + 0x14]
mov dword [edi + 0xd80], eax
lea eax, [ebp - 4]
push eax
push 0x2000000
push ebx
push 0x5c00255c
mov dword [edi + 0xed4], 0x5c019c10
mov dword [edi + 0xed8], 0x5c019860
mov dword [edi + 0xedc], 0x5c0198f0
mov dword [edi + 0xee0], 0x5c019690
mov dword [edi + 0xee4], 0x5c019730
mov dword [edi + 0xee8], 0x5c0197a0
mov dword [edi + 0xeec], 0x5c0196d0
mov dword [edi + 0xef0], 0x5c019720
push 0x80000002
mov dword [edi + 0xeb8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c016929
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
mov esi, ebx
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x5c003044
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x5c0168df
cmp dword [ebp - 0xc], 4
jne 0x5c0168df
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x5c003058
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x5c01691f
cmp dword [ebp - 0xc], 4
jne 0x5c01691f
cmp dword [ebp - 0x10], ebx
jne 0x5c016919
or dword [edi + 0xeb8], 0xffffffff
jmp 0x5c01691f
mov dword [edi + 0xeb8], esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret 0x10

Function at 0x5c01a3a6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x2000000
push edi
push 0x5c00255c
push 0x80000002
mov esi, edx
mov dword [ebp - 4], edi
mov ebx, ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c01a406
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
jne 0x5c01a402
cmp dword [ebp - 8], ebx
jne 0x5c01a402
inc edi
mov eax, edi
jmp 0x5c01a408
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5c04fa70
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x5c04faae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x5c04faa6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x5c04fab0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x5c04fa96
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5c04fb80
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x5c04fbb1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x5c04fbb1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x5c04fbb1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret