joyce8/EMBER2024-capa huggingface dataset:
Function at 0x520f3f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005145a2
and dword [ebp - 4], 0
cmp dword [0x5c00c0], 0
mov ebx, eax
jne 0x520ff0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5210a1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5210a1
push eax
call fcn.00514530
mov dword [esp], 0x566038
push edi
mov dword [0x5c00c0], eax
call esi
push eax
call fcn.00514530
mov dword [esp], 0x566024
push edi
mov dword [0x5c00c4], eax
call esi
push eax
call fcn.00514530
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5c00c8], eax
call esi
push eax
call fcn.00514530
pop ecx
mov dword [0x5c00d0], eax
test eax, eax
je 0x520ff0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00514530
pop ecx
mov dword [0x5c00cc], eax
mov eax, dword [0x5c00cc]
cmp eax, ebx
je 0x521048
cmp dword [0x5c00d0], ebx
je 0x521048
push eax
call fcn.005145ab
push dword [0x5c00d0]
mov esi, eax
call fcn.005145ab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x521048
test edi, edi
je 0x521048
call esi
test eax, eax
je 0x52103f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x52103f
test byte [ebp - 0xc], 1
jne 0x521048
or dword [ebp + 0x10], 0x200000
jmp 0x521081
mov eax, dword [0x5c00c4]
cmp eax, ebx
je 0x521081
push eax
call fcn.005145ab
pop ecx
test eax, eax
je 0x521081
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x521081
mov eax, dword [0x5c00c8]
cmp eax, ebx
je 0x521081
push eax
call fcn.005145ab
pop ecx
test eax, eax
je 0x521081
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5c00c0]
call fcn.005145ab
pop ecx
test eax, eax
je 0x5210a1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5210a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x532470
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553394
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5b3940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.00405720
movzx eax, al
test eax, eax
je 0x5324b1
xor eax, eax
jmp 0x5325c3
mov ecx, dword [ebp + 8]
push ecx
call fcn.00535e90
add esp, 4
cmp eax, 0xa
jae 0x5324cc
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5324e1
xor eax, eax
jmp 0x5325c3
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00406150
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0041d570
mov byte [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x24], ax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.00405840
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x24]
push edx
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x38]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx]
mov eax, dword [edx + 0xe8]
call eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x532572
movsx ecx, word [ebp - 0x24]
test ecx, ecx
jne 0x532580
cmp dword [ebp + 0xc], 0
je 0x532580
mov ecx, dword [ebp - 0x44]
call fcn.005321d0
cmp dword [ebp - 0x28], 0
jl 0x532598
movsx edx, word [ebp - 0x24]
cmp edx, 0xffffffff
jne 0x532598
mov dword [ebp - 0x4c], 1
jmp 0x53259f
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00406130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004061c0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x532600
Capabilities:
Check if file exists
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55160a
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x5b3940]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x240]
call fcn.0041c2b0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
je 0x53267a
push 1
mov ecx, dword [ebp - 0x254]
call fcn.0041c3a0
mov dword [ebp - 0x260], eax
jmp 0x532684
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x234]
push ecx
push 0
mov edx, dword [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x224]
push ecx
mov edx, dword [ebp - 0x234]
push edx
mov eax, dword [ebp - 0x240]
push eax
lea ecx, [ebp - 0x250]
call fcn.0053d170
mov byte [ebp - 4], 1
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.0050bed0
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
push 0
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x23c]
call fcn.00405840
push eax
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x53276f
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x53276f
push 0
lea ecx, [ebp - 0x238]
call fcn.00405840
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0041c160
add esp, 0xc
mov ecx, dword [ebp - 0x234]
push ecx
push 0
mov edx, dword [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x532791
mov ecx, dword [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x25c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x250]
call fcn.0053d150
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.0041c370
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050bb49
mov esp, ebp
pop ebp
ret
Function at 0x533450
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5528d2
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x5b3940]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x434], 0
mov eax, dword [0x5c0f8c]
and eax, 1
jne 0x5334b5
mov ecx, dword [0x5c0f8c]
or ecx, 1
mov dword [0x5c0f8c], ecx
mov ecx, 0x5c0f88
call fcn.00401410
push 0x55d910
call fcn.0050cb8a
add esp, 4
mov ecx, 0x5c0f88
call fcn.00401320
movzx edx, al
test edx, edx
jne 0x5334ea
push 0x5c0f88
mov ecx, dword [ebp + 8]
call fcn.00401800
mov eax, dword [ebp - 0x434]
or eax, 1
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 8]
jmp 0x533671
lea ecx, [ebp - 0x14]
push ecx
call fcn.005386d0
add esp, 4
mov dword [ebp - 4], 0
push str.translations.ini
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.004015d0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00405840
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5335cb
xor ecx, ecx
mov word [ebp - 0x224], cx
push 0x206
push 0
lea edx, [ebp - 0x222]
push edx
call fcn.0050bed0
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00405840
push eax
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
push str.Path
push 0x56d154
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx ecx, word [ebp - 0x224]
test ecx, ecx
je 0x5335cb
xor edx, edx
mov word [ebp - 0x42c], dx
push 0x206
push 0
lea eax, [ebp - 0x42a]
push eax
call fcn.0050bed0
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00405840
push eax
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x42c]
push eax
mov ecx, 0x5c0f88
call fcn.00402dd0
mov ecx, 0x5c0f88
call fcn.00401320
movzx ecx, al
test ecx, ecx
je 0x53362a
push str.translations_
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x430]
push eax
call fcn.004015d0
add esp, 0xc
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0x43c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x43c]
push edx
mov ecx, 0x5c0f88
call fcn.00401960
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x430]
call fcn.00407f90
push 0x5c0f88
call fcn.00536720
add esp, 4
push 0x5c0f88
mov ecx, dword [ebp + 8]
call fcn.00401800
mov eax, dword [ebp - 0x434]
or eax, 1
mov dword [ebp - 0x434], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00407f90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00407f90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0050bb49
mov esp, ebp
pop ebp
ret
Function at 0x533690
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552918
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5b3940]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], 0
mov eax, dword [0x5c0f94]
and eax, 1
jne 0x5336f5
mov ecx, dword [0x5c0f94]
or ecx, 1
mov dword [0x5c0f94], ecx
mov ecx, 0x5c0f90
call fcn.00401410
push 0x55d900
call fcn.0050cb8a
add esp, 4
mov ecx, 0x5c0f90
call fcn.00401320
movzx edx, al
test edx, edx
jne 0x53372a
push 0x5c0f90
mov ecx, dword [ebp + 8]
call fcn.00401800
mov eax, dword [ebp - 0x228]
or eax, 1
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 8]
jmp 0x533888
lea ecx, [ebp - 0x220]
push ecx
call fcn.005386d0
add esp, 4
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], edx
mov dword [ebp - 4], 0
push 0x56d038
mov eax, dword [ebp - 0x230]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.004015d0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.00407f90
lea ecx, [ebp - 0x10]
call fcn.00405840
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5337ee
xor edx, edx
mov word [ebp - 0x21c], dx
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.0050bed0
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00405840
push eax
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0x56d05c
push 0x56d074
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx edx, word [ebp - 0x21c]
test edx, edx
je 0x5337ee
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x5c0f90
call fcn.00402dd0
mov ecx, 0x5c0f90
call fcn.00401320
movzx ecx, al
test ecx, ecx
je 0x53385a
call fcn.00548d00
mov dword [ebp - 0x234], eax
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x234]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x234]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x23c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x23c]
push edx
mov ecx, 0x5c0f90
call fcn.00401960
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x224]
call fcn.00407f90
push 0x5c0f90
mov ecx, dword [ebp + 8]
call fcn.00401800
mov eax, dword [ebp - 0x228]
or eax, 1
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407f90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050bb49
mov esp, ebp
pop ebp
ret
Function at 0x533a60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5530a5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5b3940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00533920
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x533aba
mov ecx, dword [ebp + 8]
call fcn.00401410
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
jmp 0x533bb1
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00533450
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.005382b0
add esp, 8
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.00402a40
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 2
push 0x56d180
mov ecx, dword [ebp - 0x34]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.004015d0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.00407f90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.00407f90
lea ecx, [ebp - 0x14]
call fcn.00405840
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x533b7e
mov ecx, dword [ebp + 8]
call fcn.00401410
mov eax, dword [ebp - 0x24]
or eax, 1
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00407f90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407f90
mov eax, dword [ebp + 8]
jmp 0x533bb1
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401800
mov edx, dword [ebp - 0x24]
or edx, 1
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00407f90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407f90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x534610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x534675
mov dword [ebp - 0xc], 4
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x53466b
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x534680
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5346d2
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], 0
je 0x534705
push 8
lea eax, [ebp + 0x14]
push eax
push 0xb
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x5346fb
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x534710
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x534762
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], 0
je 0x53479b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x534791
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x5347b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x534802
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], 0
je 0x534844
mov eax, dword [ebp + 0x14]
push eax
call fcn.0050bba9
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x53483a
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x534850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5348c0
mov dword [ebp - 0xc], 0xb
mov dword [ebp - 0x10], 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5348b6
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x5348d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x53494f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x534945
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x534960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5349c9
mov dword [ebp - 0xc], 1
lea eax, [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5349bf
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x5349d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x534c00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x5b3940]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.0050bed0
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x534c6b
mov dword [ebp - 0x128], 0x114
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x534c6b
xor eax, eax
jmp 0x534d6b
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x534d62
cmp dword [ebp - 0x12c], 1
je 0x534d15
cmp dword [ebp - 0x12c], 2
je 0x534c9f
jmp 0x534d69
cmp dword [ebp - 0x124], 6
jb 0x534cb2
mov eax, 9
jmp 0x534d6b
cmp dword [ebp - 0x124], 5
jne 0x534cce
cmp dword [ebp - 0x120], 2
jne 0x534cce
mov eax, 8
jmp 0x534d6b
cmp dword [ebp - 0x124], 5
jne 0x534cea
cmp dword [ebp - 0x120], 1
jne 0x534cea
mov eax, 7
jmp 0x534d6b
cmp dword [ebp - 0x124], 5
jne 0x534d03
cmp dword [ebp - 0x120], 0
jne 0x534d03
mov eax, 6
jmp 0x534d6b
cmp dword [ebp - 0x124], 4
ja 0x534d13
mov eax, 5
jmp 0x534d6b
jmp 0x534d69
cmp dword [ebp - 0x124], 4
jne 0x534d2e
cmp dword [ebp - 0x120], 0
jne 0x534d2e
mov eax, 2
jmp 0x534d6b
cmp dword [ebp - 0x124], 4
jne 0x534d47
cmp dword [ebp - 0x120], 0xa
jne 0x534d47
mov eax, 3
jmp 0x534d6b
cmp dword [ebp - 0x124], 4
jne 0x534d60
cmp dword [ebp - 0x120], 0x5a
jne 0x534d60
mov eax, 4
jmp 0x534d6b
jmp 0x534d69
mov eax, 1
jmp 0x534d6b
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050bb49
mov esp, ebp
pop ebp
ret