joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ce10
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x5805c6
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x6531f0]
xor eax, esp
mov dword [esp + 0x498], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6531f0]
xor eax, esp
push eax
lea eax, [esp + 0x4b4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4c4]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, ebp
call fcn.0043d5f0
mov eax, dword [ebp + 0x18]
mov dword [eax + 4], eax
mov eax, dword [ebp + 0x18]
xor esi, esi
mov dword [ebp + 0x1c], esi
mov dword [eax], eax
mov eax, dword [ebp + 0x18]
lea edx, [esp + 0x44]
push edx
mov dword [eax + 8], eax
call fcn.0043cbc0
mov dword [esp + 0x4bc], esi
mov bl, 1
mov eax, dword [esp + 0x278]
mov byte [esp + 0x274], 0
cmp eax, 0xffffffff
je 0x43cecb
cmp byte [esp + 0x44], 0
jne 0x43ceb5
lea ecx, [esp + 0x48]
push ecx
push eax
mov byte [esp + 0x4c], bl
call sub.KERNEL32.dll_Process32FirstW
jmp 0x43cec0
lea edx, [esp + 0x48]
push edx
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x43cecb
mov byte [esp + 0x274], bl
cmp byte [esp + 0x274], 0
mov ecx, 0x8c
lea esi, [esp + 0x48]
lea edi, [esp + 0x27c]
rep movsd dword es:[edi], dword [esi]
je 0x43cf97
mov eax, dword [esp + 0x50]
cmp eax, 4
jbe 0x43ce89
push eax
call fcn.004280d0
mov edi, edx
add esp, 4
mov esi, eax
or eax, edi
je 0x43ce89
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x280]
call fcn.0043ccb0
mov byte [esp + 0x4bc], bl
mov eax, dword [eax]
mov edx, dword [esp + 0x284]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
call fcn.004026a0
mov byte [esp + 0x4bc], 3
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
push ebp
call fcn.0043d3c0
mov byte [esp + 0x4bc], bl
lea ecx, [esp + 0x2c]
call fcn.00402750
mov byte [esp + 0x4bc], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43ce89
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x43ce89
mov dword [esp + 0x4bc], 0xffffffff
lea ecx, [esp + 0x44]
push ecx
call fcn.0043cc60
mov ecx, dword [esp + 0x4b4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x498]
xor ecx, esp
call fcn.004fdb4a
add esp, 0x4ac
ret 4
Function at 0x43ec70
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [esp + 8]
push eax
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43ec90
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop ecx
ret
cmp dword [esp + 4], edi
je 0x43ec9e
mov eax, 0x1e
pop ebx
pop ecx
ret
xor eax, eax
test edi, edi
jbe 0x43ecad
xor byte [eax + esi], 0x67
inc eax
cmp eax, edi
jb 0x43eca4
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x43ecc0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push ebp
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x43ece7
pop esi
pop ebp
lea eax, [ebx + 0xe]
pop ebx
pop ecx
ret
test ebp, ebp
jbe 0x43ed03
mov ecx, dword [esp + 0x18]
push edi
sub ecx, esi
mov edi, ebp
mov dl, byte [ecx + eax]
xor dl, 0x67
mov byte [eax], dl
inc eax
sub edi, 1
jne 0x43ecf4
pop edi
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x10]
push eax
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43ed25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x43ed30
cmp dword [esp + 0xc], ebp
je 0x43ed30
mov ebx, 0x1d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x43eea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
lea eax, [edx + 0x14]
lea edi, [edx + 4]
mov ecx, 0x108
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
test eax, eax
je 0x43eedb
mov ecx, 0x104
nop
cmp word [eax], 0
je 0x43eed7
add eax, 2
sub ecx, 1
jne 0x43eec0
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 4
test ecx, ecx
jne 0x43eee6
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 4
push ebx
lea ebx, [edx + 0x21c]
test ebx, ebx
je 0x43ef14
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x43ef10
add eax, 2
sub ecx, 1
jne 0x43eef8
pop ebx
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 4
test ecx, ecx
jne 0x43ef20
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 4
test byte [ebp + 4], 1
je 0x43ef44
call fcn.00440b20
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43ef44
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
pop ebp
ret 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 4
Function at 0x43f5d0
Capabilities:
Delete file

Disassembly:
add ecx, 0x21c
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
ret

Function at 0x43f920
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push 0x10000
xor edi, edi
push 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x43f959
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_BackupRead]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
push ebp
push 0
lea ecx, [esp + 0x30]
push ecx
push 0x10000
push esi
push edx
call ebx
mov ecx, dword [esp + 0x24]
mov edi, eax
test ecx, ecx
je 0x43f9b8
xor eax, eax
test ecx, ecx
jbe 0x43f99d
lea ebx, [ebx]
xor byte [eax + esi], 0x67
inc eax
cmp eax, ecx
jb 0x43f990
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
push esi
push eax
call fcn.00496690
add esp, 0xc
cmp dword [esp + 0x24], eax
jne 0x43f9c8
test edi, edi
jne 0x43f960
jmp 0x43f9d0
test edi, edi
jne 0x43f9d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
jmp 0x43f9d0
mov dword [esp + 0x10], 0x1e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret 0xc

Function at 0x43f9f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 0x10000
xor edi, edi
push 8
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x43fa26
lea eax, [edi + 0xe]
pop edi
pop esi
pop ebp
add esp, 8
ret 8
mov dword [esp + 0xc], edi
mov edi, dword [sym.imp.KERNEL32.dll_BackupWrite]
mov eax, dword [esp + 0x1c]
push 0x10000
push esi
push eax
call fcn.004962a0
add esp, 0xc
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x43fa81
xor ecx, ecx
test eax, eax
jbe 0x43fa5f
xor byte [ecx + esi], 0x67
inc ecx
cmp ecx, eax
jb 0x43fa52
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
push 0
lea edx, [esp + 0x24]
push edx
push eax
push esi
push ebp
call edi
test eax, eax
je 0x43fa8b
cmp dword [esp + 0x18], 0x10000
jae 0x43fa30
jmp 0x43fa95
mov dword [esp + 0xc], 0x1e
jmp 0x43fa95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 8
ret 8
Function at 0x43fba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
lea eax, [edx + 0x10]
lea edi, [edx + 4]
mov ecx, 0x108
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
test eax, eax
je 0x43fbdb
mov ecx, 0x104
nop
cmp word [eax], 0
je 0x43fbd7
add eax, 2
sub ecx, 1
jne 0x43fbc0
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 4
test ecx, ecx
jne 0x43fbe6
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 4
push ebx
lea ebx, [edx + 0x218]
test ebx, ebx
je 0x43fc14
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x43fc10
add eax, 2
sub ecx, 1
jne 0x43fbf8
pop ebx
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 4
test ecx, ecx
jne 0x43fc20
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 4
test byte [ebp + 4], 1
je 0x43fc44
call fcn.00440b20
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43fc44
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
pop ebp
ret 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 4

Function at 0x43fc50
Capabilities:
Delete file
Delete registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ebp, eax
and eax, 0x100
push edi
xor edi, edi
and ebp, 0xfffffcff
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0xf023f
test byte [esi + 8], 1
mov ebx, eax
jne 0x43fcd4
lea eax, [esp + 0x10]
push eax
push ebx
push edi
lea ecx, [esi + 0x10]
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x43fcb8
push 2
push eax
mov eax, dword [esp + 0x18]
lea edx, [esi + 0x218]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
mov edi, eax
test edi, edi
jne 0x43fcb8
or dword [esi + 8], 1
jmp 0x43fcc5
lea ecx, [esi + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43fcd4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [esi + 8], 2
jne 0x43fd46
test edi, edi
jne 0x43fd46
lea edx, [esp + 0x10]
push edx
push ebx
push edi
lea eax, [esi + 0x10]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fd39
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x43fd1f
mov edx, dword [esp + 0x10]
or dword [esi + 8], 2
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0x10]
push edx
mov esi, 0x15e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
mov eax, 0x15e
pop ebx
pop ecx
ret 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x43fe20
Capabilities:
Delete file

Disassembly:
add ecx, 0x218
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
ret
Function at 0x43ffa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
lea edi, [ebp + 0x18]
mov ecx, 0x108
mov esi, edx
lea eax, [ebp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x434], 0
test eax, eax
je 0x43ffeb
mov ecx, 0x104
lea ecx, [ecx]
cmp word [eax], 0
je 0x43ffe7
add eax, 2
sub ecx, 1
jne 0x43ffd0
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 8
test ecx, ecx
jne 0x43fff6
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 8
push ebx
lea ebx, [ebp + 0x22c]
test ebx, ebx
je 0x440132
mov ecx, 0x104
mov eax, ebx
lea esp, [esp]
cmp word [eax], 0
je 0x440028
add eax, 2
sub ecx, 1
jne 0x440010
pop ebx
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 8
test ecx, ecx
je 0x440132
test byte [edx + 4], 1
je 0x440069
call fcn.00440b20
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x440054
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
pop ebp
ret 8
push ebp
call fcn.00440500
test eax, eax
jne 0x440159
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [edx + 0x41c]
test eax, eax
je 0x4400ae
mov ecx, 0x100
xor edx, edx
lea ebx, [ebx]
cmp word [eax], dx
je 0x44008f
add eax, 2
sub ecx, 1
jne 0x440080
jmp 0x440093
test ecx, ecx
jne 0x4400a5
mov edx, 0x80070057
xor eax, eax
mov esi, edx
test edx, edx
jl 0x4400b3
lea ebp, [eax + eax]
jmp 0x4400b5
mov eax, 0x100
sub eax, ecx
jmp 0x44009a
mov esi, 0x80070057
xor ebp, ebp
test esi, esi
jl 0x440132
add ebp, 2
push ebp
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
test eax, eax
je 0x440157
mov edx, dword [esp + 0x18]
mov esi, dword [edx + 0x41c]
mov ecx, ebp
shr ecx, 1
je 0x440132
cmp ecx, 0x7fffffff
ja 0x440132
mov edi, SysReAllocString
xor ebx, ebx
sub edi, ecx
mov edx, ecx
sub esi, eax
lea ecx, [edi + edx]
test ecx, ecx
je 0x44011d
movzx ecx, word [esi + eax]
test cx, cx
je 0x44011d
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x440100
jmp 0x440121
test edx, edx
jne 0x440129
sub eax, 2
mov ebx, 0x8007007a
xor edx, edx
mov word [eax], dx
test ebx, ebx
jge 0x44013e
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 8
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
pop ebx
pop edi
mov dword [eax + 8], ebp
pop esi
mov dword [eax + 0x434], ecx
xor eax, eax
pop ebp
ret 8
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x4401b0
Capabilities:
Delete file
Delete registry value

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ebp, eax
and eax, 0x100
push edi
xor edi, edi
and ebp, 0xfffffcff
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0xf023f
test byte [esi + 0x1c], 1
mov dword [esp + 0x10], eax
jne 0x44027c
lea ecx, [esp + 0xc]
push ecx
push eax
push edi
lea edx, [esi + 0x24]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x440260
mov eax, dword [esp + 0xc]
call fcn.00440410
mov edi, eax
test edi, edi
jne 0x440260
push ebx
push eax
push 0x80
push 2
push eax
push 1
push 0x40000000
lea eax, [esi + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44025b
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 8]
lea eax, [ecx + edx + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
push ebx
call fcn.0043ecc0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x440254
or dword [esi + 0x1c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
test edi, edi
je 0x44026d
lea edx, [esi + 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44027c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [esi + 0x1c], 2
jne 0x4402f8
test edi, edi
jne 0x4402f8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
push edi
lea edx, [esi + 0x24]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4402ea
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4402cf
mov edx, dword [esp + 0xc]
or dword [esi + 0x1c], 2
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 0xc]
push edx
mov esi, 0x15e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 8
ret 4
pop edi
pop esi
mov eax, 0x15e
pop ebp
add esp, 8
ret 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret 4
Function at 0x440310
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test al, 1
je 0x4403d3
test al, 2
je 0x4403d3
mov eax, dword [esi + 0x20]
mov ecx, eax
and eax, 0x100
and ecx, 0xfffffcff
neg eax
push edi
sbb eax, eax
and eax, 0xffffff00
lea edx, [esp + 8]
push edx
add eax, 0xf023f
push eax
push 0
lea eax, [esi + 0x24]
push eax
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4403ba
cmp byte [esp + 0x14], al
je 0x440397
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440397
lea edi, [eax + 0x50]
jmp 0x4403ba
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x4403ba
mov eax, dword [esp + 8]
test eax, eax
je 0x4403c9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret 0xc
xor eax, eax
pop esi
add esp, 8
ret 0xc

Function at 0x4403e0
Capabilities:
Delete file

Disassembly:
add ecx, 0x22c
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
ret

Function at 0x440410
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esi + 4]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
push ebx
mov dword [esp + 0x20], 0
call ebp
test eax, eax
jne 0x44047a
mov eax, dword [esi + 8]
mov ecx, dword [esp + 8]
push edi
lea edx, [ecx + eax + 4]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x440480
lea ebx, [eax + 0xe]
test edi, edi
je 0x440477
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 8]
lea eax, [esp + 0xc]
push eax
lea edx, [edi + ecx + 4]
mov ecx, dword [esi + 4]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push ecx
push ebx
call ebp
mov ebx, eax
test ebx, ebx
jne 0x440463
mov eax, dword [esp + 0x10]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], eax
mov dword [edi + edx], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
push edi
call fcn.00501eb0
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x18]
lea ecx, [edi + eax + 4]
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], ecx
test eax, eax
je 0x4404e6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 4], edi
mov dword [esi + 0x434], edi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x440500
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x44053d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ecx
ret 4
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44056a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
test edi, edi
jne 0x440588
push esi
mov dword [esp + 0x10], 0x54f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
push ebx
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x18]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
push edi
push esi
push edx
mov dword [ebp + 4], esi
mov dword [ebp + 0x434], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4405c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4405e9
cmp dword [esp + 0x10], edi
je 0x4405d4
mov ebx, 0x1e
jmp 0x4405e9
xor eax, eax
test edi, edi
jbe 0x4405e9
lea ebx, [ebx]
xor byte [eax + esi], 0x67
inc eax
cmp eax, edi
jb 0x4405e0
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x440663
mov esi, dword [ebp + 4]
mov eax, edi
shr eax, 1
test esi, esi
je 0x440639
cmp eax, 0x7fffffff
ja 0x440639
mov edx, eax
mov ecx, esi
test eax, eax
je 0x440624
jmp 0x440610
cmp word [ecx], 0
je 0x440620
add ecx, 2
sub edx, 1
jne 0x440610
jmp 0x440624
test edx, edx
jne 0x440635
mov ebx, 0x80070057
xor eax, eax
mov ecx, ebx
test ebx, ebx
jl 0x44063e
add eax, eax
jmp 0x440640
sub eax, edx
jmp 0x44062b
mov ecx, 0x80070057
xor eax, eax
test ecx, ecx
jl 0x440663
add eax, 2
lea ecx, [eax + 4]
cmp ecx, edi
ja 0x440663
mov edx, dword [esi + eax]
sub edi, eax
lea ecx, [esi + eax + 4]
sub edi, 4
mov dword [ebp + 0x14], edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edi
mov esi, dword [esp + 0x18]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x440820
Capabilities:
Check if file exists
Create directory
Get file attributes
Link many functions at runtime

Disassembly:
push esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlNtStatusToDosError
push eax
mov dword [0x66b048], eax
call esi
mov dword [0x66b04c], eax
mov eax, dword [0x66b048]
push str.ZwQueryInformationFile
push eax
call esi
mov ecx, dword [0x66b048]
push str.ZwCreateFile
push ecx
mov dword [0x66b05c], eax
call esi
mov edx, dword [0x66b048]
push str.RtlInitUnicodeString
push edx
mov dword [0x66b054], eax
call esi
mov dword [0x66b050], eax
mov eax, dword [0x66b048]
push str.ZwSetInformationFile
push eax
call esi
mov ecx, dword [esp + 8]
mov dword [0x66b058], eax
push ecx
mov eax, SysReAllocString
mov ecx, 0x104
mov edx, 0x66ae40
call fcn.0043ec10
pop esi
test eax, eax
jge 0x4408b9
xor edx, edx
mov word [0x66ae40], dx
lea eax, [edx + 0x57]
ret
push 0x66ae40
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4408e0
push 0
push 0x66ae40
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4408e0
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
ret

Function at 0x440b20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x6531f0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push ebx
xor esi, esi
call ebp
cmp eax, 0xffffffff
jne 0x440b90
mov esi, 3
mov dword [esp + 8], 0
test ebx, ebx
je 0x440b75
push edi
lea edi, [esp + 0xc]
mov ecx, 0x104
mov edx, ebx
call fcn.0043ebd0
pop edi
test eax, eax
jl 0x440b7a
mov ecx, dword [esp + 8]
add ecx, ecx
jmp 0x440b7c
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
jne 0x440b90
shr ecx, 1
je 0x440b90
cmp word [ebx + ecx*2], 0x5c
je 0x440ba9
sub ecx, 1
jne 0x440b84
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004fdb4a
add esp, 0x210
ret
lea esi, [ebx + ecx*2]
test esi, esi
je 0x440c09
push 0x66ae40
mov eax, SysReAllocString
mov ecx, 0x104
lea edx, [esp + 0x10]
call fcn.0043ec10
push esi
lea esi, [esp + 0x10]
call fcn.0043eb90
mov eax, esi
push eax
call ebp
cmp eax, 0xffffffff
je 0x440c09
mov ecx, esi
push ecx
mov eax, SysReAllocString
mov ecx, 0x104
mov edx, ebx
call fcn.0043ec10
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004fdb4a
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
pop esi
pop ebp
xor ecx, esp
mov eax, 3
call fcn.004fdb4a
add esp, 0x210
ret