joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570ad0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0x60d59c
push 0
mov esi, ecx
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x570b21
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
push 0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 8]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x57d520
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x3c], 0xffffffff
jne 0x57d570
mov eax, dword [0x650a58]
test eax, eax
je 0x57d5f2
mov ecx, dword [esi + 0x38]
lea esp, [esp]
cmp dword [eax + 0x3c], ecx
je 0x57d56e
mov eax, dword [eax + 0x80]
test eax, eax
jne 0x57d550
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov esi, eax
test esi, esi
je 0x57d5f2
mov ecx, dword [esi + 4]
call fcn.00594d60
test eax, eax
jne 0x57d588
mov ecx, dword [0x65bfc4]
jmp 0x57d5df
push 0x60e810
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00543349
add esp, 0xc
push dword [esi + 4]
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.005c1c80
add esp, 4
lea eax, [ebp - 0x210]
push 1
push 0
push eax
push str.explorer.exe
push 0x60e840
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x57d5f2
mov ecx, dword [0x65be24]
sub esp, 8
xor dl, dl
push dword [0x65be50]
call fcn.00593d10
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret

Function at 0x57e280
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [esi + esi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x650cb0], eax
test eax, eax
je 0x57e2dd
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push esi
push eax
call fcn.00543349
add esp, 0xc
push dword [0x650cb0]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x650cb0]
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
ret
Function at 0x591070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x653364]
push esi
mov esi, edx
cmp ecx, 0xffffffff
jne 0x5910ac
xor edx, edx
push ecx
lea ecx, [edx + 6]
call fcn.005bd370
xor ecx, ecx
add esp, 4
test al, al
setne cl
mov dword [0x653364], ecx
test ecx, ecx
je 0x59115e
call dword [0x649024]
test eax, eax
jne 0x59115e
push ecx
lea ecx, [ebp - 0x20c]
call fcn.005b9640
push 0x60e030
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.005c1c80
push 0x3c
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00546fa0
add esp, 0x14
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x244], 0x400
mov dword [ebp - 0x23c], 0x60e054
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x234], 0x60e060
test esi, esi
jne 0x591142
mov dword [ebp - 0x234], 0x60e074
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x5915d0
Capabilities:
Terminate process

Disassembly:
cmp byte [0x652df4], 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
je 0x591803
mov ecx, 0x651032
call fcn.00594d60
test eax, eax
setne bl
test bl, bl
je 0x591622
xor edx, edx
mov ecx, 0x651032
call fcn.0059c500
test eax, eax
je 0x59160f
lea eax, [esi + 1]
jmp 0x591620
mov ecx, 0x651032
call fcn.0059c840
neg eax
sbb eax, eax
and eax, 2
or bl, al
movzx eax, bl
sub eax, 0
je 0x5917d5
dec eax
je 0x59175d
sub eax, 2
jne 0x59186c
cmp byte [0x650d22], al
jne 0x591667
cmp byte [0x650c7c], al
jne 0x591667
mov ecx, dword [0x65bd70]
sub esp, 8
xor dl, dl
push dword [0x65be4c]
call fcn.00593d10
add esp, 0xc
cmp byte [0x652dfa], 0
je 0x591698
push 1
push 0x651032
call fcn.0058c7e0
test eax, eax
je 0x591894
push 1
push 0x651460
call fcn.0058c7e0
test eax, eax
je 0x591894
mov ecx, edi
mov byte [0x650ce5], 1
call fcn.00592410
mov esi, eax
cmp esi, 2
je 0x591894
cmp byte [0x652dfa], 0
mov al, byte [0x65145e]
jne 0x5916cb
cmp al, 4
je 0x5916cb
cmp al, 5
jne 0x591868
cmp al, 5
sete bl
xor ecx, ecx
call fcn.0059c900
test eax, eax
je 0x5916f9
test bl, bl
jne 0x591725
mov ecx, dword [0x65beb8]
sub esp, 8
xor dl, dl
push 0
call fcn.00593d10
add esp, 0xc
jmp 0x591868
test bl, bl
jne 0x591725
push 1
push 0x651032
call fcn.0058c7e0
test eax, eax
je 0x591894
push 1
push 0x651460
call fcn.0058c7e0
test eax, eax
je 0x591894
mov ecx, 0x651460
call fcn.0059cb10
mov ecx, edi
mov byte [0x650ce5], 2
mov byte [0x650ce3], 1
call fcn.00592410
mov esi, eax
cmp esi, 2
je 0x591894
mov dl, bl
mov ecx, esi
call fcn.0059cc50
jmp 0x591868
sub esp, 8
cmp byte [0x650d22], 0
push dword [0x65be4c]
je 0x5917c1
mov ecx, dword [0x65be38]
mov dl, 1
call fcn.00593d10
mov esi, eax
add esp, 0xc
cmp esi, 1
jne 0x591894
cmp byte [0x650c7c], 0
jne 0x591868
cmp byte [0x650d22], 0
jne 0x591829
mov ecx, dword [0x65be40]
sub esp, 8
xor dl, dl
push dword [0x65be4c]
call fcn.00593d10
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x65be3c]
xor dl, dl
call fcn.00593d10
add esp, 0xc
pop edi
pop esi
pop ebx
ret
sub esp, 8
cmp byte [0x650d22], 0
push dword [0x65be4c]
je 0x5917ef
mov ecx, dword [0x65be30]
jmp 0x591775
mov ecx, dword [0x65be34]
xor dl, dl
call fcn.00593d10
add esp, 0xc
pop edi
pop esi
pop ebx
ret
cmp dword [0x65bcc0], 0
je 0x59178a
call fcn.0056f7e0
test al, al
je 0x591821
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [0x649024]
test eax, eax
jne 0x59183c
call fcn.00591590
test eax, eax
je 0x591894
push 0x60dfb0
push 0x105
push 0x651032
call fcn.00543349
add esp, 0xc
mov ecx, edi
mov byte [0x650ce5], 3
call fcn.00592410
mov esi, eax
cmp esi, 2
je 0x591894
test esi, esi
je 0x591894
lea ecx, [edi + 0xd0]
mov dword [edi + 0x20], 0x65f7b8
mov byte [0x650ce1], 1
mov eax, dword [ecx]
call dword [eax + 0x170]
call fcn.005bd480
mov byte [0x650ce1], 0
pop edi
pop esi
pop ebx
ret
Function at 0x593be0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 1
push 0
push 0
mov esi, ecx
push esi
push 0x60dea0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x593cfe
lea eax, [ebp - 0x21c]
push eax
push str.gopherDefaultIcon
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x593cfe
mov ebx, dword [ebp - 0x21c]
lea eax, [ebp - 0x214]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push ebx
mov dword [ebp - 0x214], 0x208
call dword [0x64904c]
test eax, eax
jne 0x593c9e
mov eax, dword [ebp - 0x218]
cmp eax, 1
je 0x593c72
cmp eax, 2
jne 0x593c9e
cmp dword [ebp - 0x214], 0x208
ja 0x593c9e
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push ebx
call dword [0x64904c]
push dword [ebp - 0x21c]
call dword [0x649028]
lea eax, [ebp - 0x210]
push 0x60ded4
push eax
call fcn.005433a5
add esp, 8
test eax, eax
je 0x593cc7
xor ecx, ecx
mov word [eax], cx
push 1
push 0
push esi
lea eax, [ebp - 0x210]
push eax
push 0x60ded8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x593cfe
mov ecx, dword [0x65be20]
sub esp, 8
xor dl, dl
push dword [0x65be50]
call fcn.00593d10
add esp, 0xc
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00541b41
mov esp, ebp
pop ebp
ret

Function at 0x594000
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0042def3
mov eax, dword [eax + 8]
push 9
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push edi
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push edi
push 0
push 0x80
push dword [ebx + 0x20]
call esi
push edi
call dword [sym.imp.USER32.dll_DestroyIcon]
fld dword [0x650d1c]
fldz
fucompp
fnstsw ax
test ah, 0x44
jp 0x594094
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00429fbe
mov esi, eax
push 0x58
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fdiv qword [0x6226f0]
fstp dword [0x650d1c]
push dword [esi + 4]
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5945b0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x679b7c], 0
je 0x5945df
mov eax, dword [0x679b78]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x11c
push eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x120]
push eax
call fcn.00546fa0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x594657
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
push 0x60f05c
push 0x60f070
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x59467d
lea ecx, [ebp - 0x148]
push ecx
call eax
jmp 0x59468a
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x110], 2
jne 0x5946f4
mov eax, dword [ebp - 0x11c]
cmp eax, 4
jbe 0x5946f4
cmp eax, 6
jne 0x5946f4
cmp dword [ebp - 0x118], 0
jne 0x5946f4
cmp byte [ebp - 6], 1
je 0x594647
push str.GetProductInfo
push 0x60f09c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x124]
push ecx
push 0
push 0
push 0
push 6
call eax
mov eax, dword [ebp - 0x124]
add eax, 0xfffffff4
cmp eax, 2
ja 0x5946f4
mov eax, 1
mov dword [0x679b78], eax
jmp 0x5946f9
mov eax, dword [0x679b78]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x679b7c], 1
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x595020
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x595057
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push 0x60f0b8
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x595047
push 0x80020003
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x5996d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, 0x651032
test edx, edx
je 0x5996f5
mov esi, 0x651460
push esi
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test edi, edi
jne 0x599738
push edi
push ecx
lea ecx, [ebp - 0x218]
call fcn.005c47d0
lea eax, [ebp - 0x218]
push eax
mov edx, 0x105
mov ecx, esi
call fcn.005c1c80
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
push edi
mov edx, 0x105
mov ecx, esi
call fcn.005c1c80
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x59df80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x868
mov eax, dword [0x64e0a0]
xor eax, esp
mov dword [esp + 0x864], eax
mov eax, dword [0x679b20]
push esi
push edi
test eax, eax
je 0x59dfb6
push eax
call dword [0x649008]
mov dword [0x679b20], 0
lea eax, [esp + 0x448]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x240]
call fcn.005c47d0
lea ecx, [esp + 0x450]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x59dfe5
sub ecx, edx
sar ecx, 1
lea eax, [esp + 0x448]
cmp ecx, 0x105
jae 0x59e01b
push eax
lea eax, [esp + 0x65c]
push 0x105
push eax
call fcn.00543349
add esp, 0xc
jmp 0x59e040
push 0x104
push eax
lea eax, [esp + 0x660]
push 0x105
push eax
call fcn.00543d6d
add esp, 0x10
xor eax, eax
mov word [esp + 0x860], ax
lea eax, [esp + 0x238]
push eax
mov edx, 0x105
lea ecx, [esp + 0x65c]
call fcn.005c1c80
add esp, 4
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x65c]
push eax
call fcn.005440be
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x59e1ad
lea esp, [esp]
lea ecx, [esp + 0x448]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x59e090
sub ecx, edx
sar ecx, 1
lea eax, [esp + 0x448]
cmp ecx, 0x105
jae 0x59e0c6
push eax
lea eax, [esp + 0x23c]
push 0x105
push eax
call fcn.00543349
add esp, 0xc
jmp 0x59e0eb
push 0x104
push eax
lea eax, [esp + 0x240]
push 0x105
push eax
call fcn.00543d6d
add esp, 0x10
xor eax, eax
mov word [esp + 0x440], ax
lea eax, [esp + 0x238]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x59e0f5
sub eax, edx
lea edx, [esp + 0x2c]
sar eax, 1
lea esi, [edx + 2]
jmp 0x59e110
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x59e110
sub edx, esi
lea ecx, [eax + 1]
sar edx, 1
cmp ecx, 0x105
jae 0x59e182
lea ecx, [eax + 1]
add ecx, edx
cmp ecx, 0x105
ja 0x59e153
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x23c]
push 0x105
push eax
call fcn.0054640f
add esp, 0xc
jmp 0x59e182
mov ecx, 0x104
sub ecx, eax
push ecx
lea ecx, [esp + 0x30]
push ecx
mov ecx, 0x105
sub ecx, eax
push ecx
lea eax, [esp + eax*2 + 0x244]
push eax
call fcn.00543d6d
add esp, 0x10
xor eax, eax
mov word [esp + 0x440], ax
lea ecx, [esp + 0x238]
call fcn.00595350
lea eax, [esp + 8]
push eax
push edi
call fcn.005441e3
add esp, 8
test eax, eax
je 0x59e080
push edi
call fcn.005442f8
add esp, 4
mov ecx, dword [esp + 0x86c]
pop edi
pop esi
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x59f9e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7288
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 4]
cmp dword [edx + 0x24], 0
jl 0x59fa1c
mov eax, dword [edx + 0x20]
mov edx, dword [eax]
jmp 0x59fa1f
mov edx, dword [edx + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp word [edx], ax
jne 0x59fa3c
xor ecx, ecx
jmp 0x59fa50
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x59fa41
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.004035e0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0
mov ecx, dword [esi + 4]
push eax
call fcn.00567ec0
cmp dword [ebp - 0x1c], 0
jne 0x59fa7a
mov esi, 2
jmp 0x59faf9
call fcn.0059f840
test al, al
jne 0x59fa8a
mov esi, 1
jmp 0x59faf9
call dword [0x649024]
test eax, eax
je 0x59fa9b
mov esi, 1
jmp 0x59faf9
push 0x38
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00546fa0
mov eax, dword [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x400
mov dword [ebp - 0x74], str.runas
jae 0x59facc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x64], 1
jae 0x59fae2
lea eax, [ebp - 0x44]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea esi, [eax - 1]
neg esi
sbb esi, esi
and esi, 2
cmp dword [ebp - 0x30], 8
jb 0x59fb0a
push dword [ebp - 0x44]
call fcn.00421634
add esp, 4
xor eax, eax
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
jb 0x59fb2f
push dword [ebp - 0x2c]
call fcn.00421634
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret 4
Function at 0x5a1920
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x65c1e4], 0
jne 0x5a1951
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esp, ebp
pop ebp
ret 0x20
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
js 0x5a1a48
test ecx, ecx
jne 0x5a1a48
test eax, eax
jne 0x5a1a48
mov ecx, dword [ebp + 0x10]
push edi
test ecx, ecx
je 0x5a1a3b
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x5a1a3b
mov eax, dword [edi]
push esi
lea eax, [eax*2 + 0x16]
push eax
mov dword [ebp + 0x14], eax
call fcn.005421d4
mov esi, eax
add esp, 4
test esi, esi
jne 0x5a19b2
lea eax, [esi + 8]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push esi
push 0
push dword [ebp + 0xc]
push ebx
call fcn.0041e973
mov ebx, eax
test ebx, ebx
js 0x5a1a0c
mov eax, dword [esi + 0xc]
mov ecx, eax
shr ecx, 1
cmp ecx, dword [edi]
jae 0x5a1a34
push eax
lea eax, [esi + 0x10]
push eax
push dword [ebp + 0x10]
call fcn.005495a0
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 0x10]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 0x24]
shr eax, 1
add esp, 0xc
mov dword [edi], eax
test ecx, ecx
je 0x5a1a0c
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
cmp ebx, 0x80000005
jne 0x5a1a1c
mov eax, dword [esi + 0xc]
shr eax, 1
inc eax
mov dword [edi], eax
push esi
call fcn.00541b50
add esp, 4
push ebx
call fcn.0041e908
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov ebx, htons
jmp 0x5a1a14
pop edi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x20
push dword [ebp + 0x24]
push eax
push ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x5a4bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, edx
or eax, 0xffffffff
xor esi, esi
test edi, edi
je 0x5a4c1b
lea ecx, [ecx]
movzx edx, byte [esi + ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x611168]
inc esi
cmp esi, edi
jb 0x5a4c00
pop edi
not eax
pop esi
ret
Function at 0x5a67b0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
ret
Function at 0x5a82d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
add dword [ecx], 0x24
push esi
push edi
mov edi, dword [edx + 0x20]
mov dword [edx + 0x20], 0
or eax, 0xffffffff
inc edx
mov esi, 6
jmp 0x5a82f0
movzx ecx, byte [edx - 1]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
movzx ecx, byte [edx]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
movzx ecx, byte [edx + 1]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
movzx ecx, byte [edx + 2]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
movzx ecx, byte [edx + 3]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
movzx ecx, byte [edx + 4]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
lea edx, [edx + 6]
dec esi
jne 0x5a82f0
not eax
sub eax, edi
neg eax
sbb eax, eax
pop edi
and eax, 0x1770
pop esi
ret

Function at 0x5a8390
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
add dword [ecx], 0x108
push esi
mov esi, dword [edx + 0x104]
push edi
mov dword [edx + 0x104], 0
or ecx, 0xffffffff
inc edx
mov edi, 0x2c
movzx eax, byte [edx - 1]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x611168]
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x611168]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x611168]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x611168]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x611168]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x611168]
lea edx, [edx + 6]
dec edi
jne 0x5a83b1
not ecx
sub esi, ecx
neg esi
sbb esi, esi
and esi, 0x1770
pop edi
mov eax, esi
pop esi
ret

Function at 0x5a8450
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov eax, dword [ebx]
lea edx, [ebp - 4]
push edx
add eax, 0x100
push 0
push eax
push 0x1c
mov edx, esi
call fcn.005a92b0
add esp, 0x10
test eax, eax
jne 0x5a852f
cmp dword [ebp - 4], 0x1c
jne 0x5a852f
cmp dword [esi + 4], 5
je 0x5a849c
mov eax, 0x1771
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], 0
or eax, 0xffffffff
lea edx, [esi + 1]
mov edi, 7
movzx ecx, byte [edx - 1]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
movzx ecx, byte [edx]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
movzx ecx, byte [edx + 1]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
movzx ecx, byte [edx + 2]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x611168]
lea edx, [edx + 4]
dec edi
jne 0x5a84b4
not eax
cmp dword [ebp - 4], eax
jne 0x5a852f
cmp dword [esi], 0x45fa785e
jne 0x5a852f
add dword [ebx], 0x11c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x1770
pop ebx
mov esp, ebp
pop ebp
ret