joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a70c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov eax, dword [ebx + 0x10]
push edi
cmp eax, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov edi, 0x1021
jle 0x41a764
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404cd4
mov al, byte [eax]
push 8
pop edx
mov cl, al
and cl, 0x80
neg cl
sbb ecx, ecx
neg ecx
test si, 0x8000
je 0x41a756
xor ecx, edi
add esi, esi
shl al, 1
xor esi, ecx
dec edx
jne 0x41a742
dec dword [ebp + 8]
jne 0x41a72e
push 0x10
pop ecx
mov eax, esi
and ax, 0x8000
neg ax
sbb eax, eax
add esi, esi
and eax, edi
xor esi, eax
dec ecx
jne 0x41a767
mov ax, si
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41add3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push 4
pop esi
mov eax, dword [esp + 8]
and eax, 0xff
xor dword [ecx + 0x24], eax
lea edx, [eax + 1]
add dword [ecx + 0x28], edx
mov edx, dword [ecx + 0x2c]
test edx, 0x80000000
je 0x41adf5
inc eax
shr dword [esp + 8], 8
lea eax, [eax + edx*2]
dec esi
mov dword [ecx + 0x2c], eax
jne 0x41add7
pop esi
ret 4

Function at 0x41fecb
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push esi
lea ecx, [ebp - 0xc]
call fcn.00402ea1
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0xc]
push eax
push 0x106
call fcn.004032cd
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [ebp - 0xc]
call fcn.0040330b
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41ff82
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.00403092
cmp eax, 0xffffffff
je 0x41ff38
push dword [ebp - 8]
inc eax
lea ecx, [ebp - 0xc]
push eax
call fcn.00403827
test byte [ebp - 0x15c], 0x10
jne 0x41ff69
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004039af
mov ecx, dword [ebp + 0xc]
add esp, 0xc
push eax
call fcn.00403caf
lea ecx, [ebp - 0x1c]
call fcn.00402fbc
lea eax, [ebp - 0x15c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ff38
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0xc]
call fcn.00402fbc
pop esi
leave
ret 8
Function at 0x42005c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push dword [ecx + 8]
lea ecx, [ebp - 4]
call fcn.00404256
xor eax, eax
cmp dword [ebp - 4], 0xffffffff
setne al
test al, al
jne 0x42008d
lea ecx, [ebp - 4]
call fcn.00404276
xor ax, ax
jmp 0x420112
push edi
push ebx
lea ecx, [ebp - 4]
call fcn.00404355
mov ebx, eax
push ebx
call fcn.004345c0
pop ecx
mov edi, eax
push ebx
push edi
lea ecx, [ebp - 4]
call fcn.004042e3
lea ecx, [ebp - 4]
call fcn.004042c6
cmp ebx, esi
mov dword [ebp - 8], esi
jbe 0x4200fd
movzx eax, byte [esi + edi]
mov ecx, dword [ebp - 8]
mov edx, eax
and ecx, 0x7f
and edx, 0xf
xor ecx, edx
xor edx, edx
mov dl, byte [ebp - 7]
mov cx, word [ecx*2 + 0x4431f8]
xor cx, dx
mov edx, ecx
and edx, 0x7f
shr eax, 4
xor edx, eax
xor eax, eax
mov al, ch
mov cx, word [edx*2 + 0x4431f8]
xor cx, ax
inc esi
cmp esi, ebx
mov dword [ebp - 8], ecx
jb 0x4200bb
push edi
call fcn.004345d0
pop ecx
lea ecx, [ebp - 4]
call fcn.00404276
mov ax, word [ebp - 8]
pop ebx
pop edi
pop esi
leave
ret

Function at 0x4202a9
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
push dword [ebp + 8]
call fcn.00402ebe
push str._shellShtirlitzIV
lea ecx, [ebp - 0xc]
call fcn.004034ca
lea eax, [ebp - 0xc]
push str.command
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004039af
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0xc
push dword [eax]
mov edi, MenuHelp
push edi
call esi
mov ebx, eax
lea ecx, [ebp - 0x18]
neg ebx
sbb ebx, ebx
neg ebx
call fcn.00402fbc
test bl, bl
jne 0x420331
lea eax, [ebp - 0xc]
push str.ddeexec
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004039af
add esp, 0xc
push dword [eax]
push edi
call esi
mov ebx, eax
lea ecx, [ebp - 0x18]
neg ebx
sbb ebx, ebx
neg ebx
call fcn.00402fbc
test bl, bl
je 0x42033d
lea ecx, [ebp - 0xc]
call fcn.00402fbc
xor al, al
jmp 0x420354
push dword [ebp - 0xc]
push edi
call esi
mov ebx, eax
lea ecx, [ebp - 0xc]
neg ebx
sbb ebx, ebx
inc ebx
call fcn.00402fbc
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x421ca7
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push dword [esp + 0x10]
push str.open
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret 4
Function at 0x4234c4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00421117
mov edi, eax
mov dword [ebp - 0x48], 0x9c6f
mov dword [ebp - 0x44], 0xe12b
mov dword [ebp - 0x40], 0xe123
mov dword [ebp - 0x3c], 0xe122
mov dword [ebp - 0x38], 0xe124
mov dword [ebp - 0x34], 0xe129
mov dword [ebp - 0x30], 0xe103
mov dword [ebp - 0x2c], 0xe107
lea esi, [ebp - 0x48]
mov dword [ebp - 0xc], 8
and byte [ebp - 8], 0
and byte [ebp - 1], 0
test edi, edi
je 0x423535
mov eax, dword [edi]
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, edi
push dword [esi]
call dword [eax + 0x78]
push dword [ebp - 8]
mov ecx, dword [ebx + 0x1c8]
push dword [esi]
call fcn.00408a5f
add esi, 4
dec dword [ebp - 0xc]
jne 0x423518
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 1
call esi
test eax, eax
jne 0x423570
push 0xd
call esi
test eax, eax
jne 0x423570
push 0xf
call esi
test eax, eax
jne 0x423570
and byte [ebp - 0xc], al
jmp 0x423574
mov byte [ebp - 0xc], 1
push dword [ebp - 0xc]
mov ecx, dword [ebx + 0x1c8]
push 0xe125
call fcn.00408a5f
mov ecx, dword [ebx + 0x1d8]
call fcn.00407540
test al, al
je 0x4235bb
test edi, edi
je 0x4235ac
mov eax, dword [edi]
push dword [ebx + 0x1d8]
mov ecx, edi
call dword [eax + 0x98]
jmp 0x4235bb
mov ecx, dword [ebx + 0x1d8]
push 0
push 0
call fcn.0041c05c
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x10]
push 0x10
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00435130
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, eax
push str._t_.
call fcn.00402ebe
mov eax, dword [0x4436d8]
xor edx, edx
test ax, ax
je 0x42361e
mov ecx, 0x4436d8
cmp ax, si
je 0x42360b
mov ax, word [ecx + 6]
add ecx, 6
inc edx
test ax, ax
jne 0x4235f7
jmp 0x42361e
lea eax, [edx + edx*2]
lea ecx, [ebp - 0x28]
lea eax, [eax*2 + 0x4436da]
push eax
call fcn.004034ca
push dword [ebp - 0x28]
mov ecx, ebx
push 2
call fcn.0042326f
lea ecx, [ebp - 0x28]
call fcn.00402fbc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423fa2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
push ebx
push edi
lea ecx, [ebp - 0x10]
call fcn.0040672f
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
dec ebx
js 0x42403d
push esi
mov eax, dword [edi]
mov esi, ebx
shl esi, 2
mov eax, dword [eax + esi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x423fdf
push ebx
mov ecx, edi
call fcn.00403e00
jmp 0x424039
mov eax, dword [edi]
mov eax, dword [eax + esi]
push dword [eax]
call fcn.0040679c
test al, al
pop ecx
je 0x42402e
mov eax, dword [edi]
push 0
lea ecx, [ebp - 0x10]
mov eax, dword [eax + esi]
push dword [eax]
call fcn.004067d7
test al, al
je 0x42402e
cmp byte [ebp + 0xc], 0
je 0x42401b
mov eax, dword [ebp - 4]
push 2
lea ecx, [ebp - 0x10]
push dword [eax + 4]
call fcn.0040689c
test al, al
je 0x42402e
mov eax, dword [edi]
push 0
lea ecx, [ebp - 0x10]
push dword [eax + esi]
call fcn.00406855
mov eax, dword [edi]
push dword [eax + esi]
call fcn.0042404b
pop ecx
dec ebx
jns 0x423fbf
pop esi
lea ecx, [ebp - 0x10]
call fcn.00406776
pop edi
pop ebx
leave
ret 8
Function at 0x424c2c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x130], 0
je 0x424dd4
cmp byte [ebp + 8], 0x7f
jne 0x424c5a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x424dd4
mov ecx, dword [esi + 0x14c]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0040a8a1
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jne 0x424dd4
mov eax, dword [esi + 0x130]
add eax, ecx
mov bl, byte [eax]
test bl, bl
mov byte [ebp - 0xc], bl
jne 0x424c94
cmp byte [ebp + 8], 8
jne 0x424dd4
mov dl, byte [ebp + 8]
cmp dl, 0xd
je 0x424da3
cmp dl, 0xa
je 0x424da3
cmp dl, 9
je 0x424dd4
cmp dl, 8
jne 0x424d00
test ecx, ecx
je 0x424dd4
mov al, byte [eax - 1]
push eax
call fcn.00424ddc
test al, al
pop ecx
je 0x424cf8
cmp dword [ebp - 4], 0
jle 0x424dc3
mov eax, dword [esi + 0x130]
mov ecx, dword [ebp - 4]
mov al, byte [ecx + eax - 1]
push eax
call fcn.00424ddc
test al, al
pop ecx
je 0x424dc3
dec dword [ebp - 4]
jmp 0x424ccd
dec dword [ebp - 4]
jmp 0x424dc3
push dword [ebp - 0xc]
call fcn.00424ddc
test al, al
pop ecx
jne 0x424dd4
cmp bl, byte [ebp + 8]
je 0x424d87
mov ecx, dword [esi + 0x14c]
push 0
call fcn.00407675
and byte [ebp - 8], 0
mov eax, dword [esi + 0x130]
mov cl, byte [eax]
test cl, cl
je 0x424d4c
cmp cl, bl
jne 0x424d3e
mov cl, byte [ebp + 8]
mov byte [eax], cl
jmp 0x424d49
cmp cl, byte [ebp + 8]
jne 0x424d49
mov byte [eax], bl
mov byte [ebp - 8], 1
inc eax
jmp 0x424d2d
push dword [ebp - 8]
mov ecx, esi
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.00424df3
push dword [esi + 0x130]
mov ecx, dword [esi + 0x14c]
call fcn.00407691
mov ecx, dword [esi + 0x14c]
push 1
call fcn.00407675
mov ecx, dword [esi + 0x14c]
push 1
call fcn.00407594
inc dword [ebp - 4]
mov eax, dword [esi + 0x130]
mov ecx, dword [ebp - 4]
mov al, byte [ecx + eax]
push eax
call fcn.00424ddc
test al, al
pop ecx
je 0x424dc3
jmp 0x424d87
push 0xa
push eax
call fcn.00434b90
pop ecx
test eax, eax
pop ecx
je 0x424dba
sub eax, dword [esi + 0x130]
inc eax
jmp 0x424dc0
mov eax, dword [esi + 0x134]
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov ecx, dword [esi + 0x14c]
push dword [ebp - 4]
call fcn.0040a6f8
pop esi
mov al, 1
pop ebx
leave
ret 4
Function at 0x425823
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x443da4
push dword [0x447630]
lea eax, [ebp - 0x28]
mov esi, ecx
push eax
call fcn.0040465a
add esp, 0xc
mov ecx, esi
push eax
call fcn.00403163
lea ecx, [ebp - 0x28]
call fcn.00402fbc
xor ebx, ebx
lea ecx, [ebp - 0x64]
push ebx
push ebx
push dword [esi]
call fcn.00405ffc
xor eax, eax
cmp dword [ebp - 0x60], ebx
setne al
test al, al
je 0x4258e1
lea ecx, [ebp - 0x64]
call fcn.00405dc1
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.00402ea1
lea ecx, [ebp - 0x1c]
call fcn.00402ea1
cmp dword [ebp - 4], ebx
jle 0x4258c9
mov eax, dword [ebp - 4]
lea edi, [esi + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x64]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00405f33
mov ecx, eax
call fcn.00405f33
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
push dword [ebp - 0x28]
call fcn.004041a9
mov ecx, eax
call fcn.00403163
dec dword [ebp - 4]
jne 0x425898
lea ecx, [ebp - 0x64]
call fcn.00405ad3
lea ecx, [ebp - 0x1c]
call fcn.00402fbc
lea ecx, [ebp - 0x28]
call fcn.00402fbc
push ebx
lea eax, [ebp - 0x10]
push str.Font_Face
push eax
mov ecx, esi
call fcn.00425af3
cmp dword [ebp - 0xc], ebx
je 0x425919
push 0x1c
push 0x443c60
push str.Font_Style
mov ecx, esi
call fcn.00425c2b
push dword [ebp - 0x10]
push str.Courier_New
call fcn.00434d00
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x28]
push str.html_varFontFace
push eax
mov ecx, esi
call fcn.00425af3
push eax
lea ecx, [ebp - 0x10]
call fcn.00403163
lea ecx, [ebp - 0x28]
call fcn.00402fbc
cmp dword [ebp - 0xc], ebx
je 0x425962
push 0x1c
push 0x441da8
push str.html_varFontStyle
mov ecx, esi
call fcn.00425c2b
push dword [ebp - 0x10]
push str.Times_New_Roman
call fcn.00434d00
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x28]
push str.html_fixFontFace
push eax
mov ecx, esi
call fcn.00425af3
push eax
lea ecx, [ebp - 0x10]
call fcn.00403163
lea ecx, [ebp - 0x28]
call fcn.00402fbc
cmp dword [ebp - 0xc], ebx
je 0x4259ab
push 0x1c
push 0x441de8
push str.html_fixFontStyle
mov ecx, esi
call fcn.00425c2b
push dword [ebp - 0x10]
push 0x441e04
call fcn.00434d00
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x34]
push str.WorkDir
push eax
mov ecx, esi
call fcn.00425af3
cmp dword [ebp - 0x30], ebx
je 0x4259ca
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x34]
call fcn.00402fbc
lea ecx, [ebp - 0x10]
call fcn.00402fbc
lea ecx, [ebp - 0x64]
call fcn.00406030
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428c14
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4476a4]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], eax
push edi
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x48]
mov ebx, ecx
cmp ebx, eax
jle 0x428c36
mov ebx, eax
mov eax, ecx
sub eax, ebx
inc eax
mov edi, eax
lea eax, [edi + edi + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [edi + edi]
mov word [eax], di
push ecx
mov ecx, dword [esi + 0x4c]
add eax, 2
lea ecx, [ecx + ebx*2]
push ecx
push eax
call fcn.00434840
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x428c9b
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp byte [edi + 0x34], 0
jne 0x428d47
mov eax, dword [0x4476a4]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x428d47
mov ecx, dword [edi + 0x44]
mov eax, dword [edi + 0x48]
push esi
push ebx
mov ebx, ecx
cmp ebx, eax
jle 0x428cd5
mov ebx, eax
mov eax, ecx
push dword [edi + 4]
sub eax, ebx
inc eax
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
mov dword [ebp - 4], eax
je 0x428d3f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
movsx ecx, word [eax]
cmp esi, 1
jne 0x428d0a
mov esi, dword [edi + 0x3c]
shl esi, 4
sub esi, ebx
cmp esi, ecx
jle 0x428d10
mov esi, ecx
lea ecx, [esi + esi]
add eax, 2
push ecx
push eax
mov eax, dword [edi + 0x4c]
lea eax, [eax + ebx*2]
push eax
call fcn.00434840
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esi + ebx - 1]
push 1
push eax
push ebx
mov ecx, edi
call fcn.00428838
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x429561
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
cmp ecx, eax
jge 0x429584
xor eax, ecx
xor dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x44]
xor dword [esi + 0x48], eax
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x3c]
mov ebx, dword [ebp + 8]
mov edi, edx
sub edi, eax
inc edi
shl ecx, 4
mov dword [ebp - 4], ecx
lea ecx, [edi + ebx]
cmp ecx, dword [ebp - 4]
jle 0x4295a8
mov edi, dword [ebp - 4]
sub edi, ebx
lea ecx, [edi + ebx]
mov dword [ebp - 0xc], ecx
dec ecx
cmp ecx, eax
mov dword [ebp - 8], ecx
jl 0x42968c
cmp ebx, edx
jg 0x42968c
cmp ebx, eax
jge 0x429623
sub eax, ebx
add eax, eax
push eax
mov dword [ebp - 4], eax
call fcn.004345c0
mov dword [ebp + 8], eax
pop ecx
push dword [ebp - 4]
lea eax, [ebx + ebx]
add eax, dword [esi + 0x4c]
push eax
push dword [ebp + 8]
call fcn.00434840
mov eax, dword [esi + 0x4c]
add esp, 0xc
lea ecx, [edi + edi]
push ecx
mov ecx, dword [esi + 0x44]
lea ecx, [eax + ecx*2]
lea eax, [eax + ebx*2]
push ecx
push eax
call fcn.00434df0
mov eax, dword [esi + 0x4c]
mov ecx, dword [ebp - 0xc]
add esp, 0xc
lea eax, [eax + ecx*2]
push dword [ebp - 4]
push dword [ebp + 8]
push eax
call fcn.00434840
add esp, 0xc
push dword [ebp + 8]
jmp 0x429684
mov ecx, ebx
sub ecx, eax
lea eax, [ecx + ecx]
push eax
mov dword [ebp + 8], eax
call fcn.004345c0
mov edx, dword [esi + 0x4c]
pop ecx
push dword [ebp + 8]
mov ecx, edi
add ecx, dword [esi + 0x44]
mov dword [ebp - 4], eax
lea ecx, [edx + ecx*2]
push ecx
push eax
call fcn.00434840
mov eax, dword [esi + 0x4c]
add esp, 0xc
lea ecx, [edi + edi]
push ecx
mov ecx, dword [esi + 0x44]
lea ecx, [eax + ecx*2]
lea eax, [eax + ebx*2]
push ecx
push eax
call fcn.00434df0
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x4c]
add esp, 0xc
lea eax, [ecx + eax*2]
push dword [ebp + 8]
push dword [ebp - 4]
push eax
call fcn.00434840
add esp, 0xc
push dword [ebp - 4]
call fcn.004345d0
pop ecx
jmp 0x4296cf
mov edx, ebx
cmp ebx, ecx
mov dword [ebp + 8], edx
jg 0x4296cf
add eax, eax
mov ecx, dword [esi + 0x4c]
lea edi, [edx + edx]
lea edx, [eax + ecx]
mov cx, word [edi + ecx]
xor word [edx], cx
mov ecx, dword [esi + 0x4c]
lea edx, [edi + ecx]
mov cx, word [eax + ecx]
xor word [edx], cx
mov ecx, dword [esi + 0x4c]
lea edx, [eax + ecx]
mov cx, word [edi + ecx]
xor word [edx], cx
mov edx, dword [ebp + 8]
inc eax
inc eax
inc edx
cmp edx, dword [ebp - 8]
mov dword [ebp + 8], edx
jle 0x429697
push 1
mov ecx, esi
push dword [ebp - 8]
push ebx
call fcn.00428838
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42e1c6
Capabilities:
Enumerate files on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x447348
mov ecx, esi
call fcn.004031a9
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push dword [0x443c9c]
push MenuHelp
push eax
call fcn.0040bd10
add esp, 0x10
lea ecx, [ebp - 0x24]
push 0x5c
call fcn.004035a6
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x24]
push 0x443eb8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004039af
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0xc]
mov edi, eax
call fcn.00402fbc
cmp edi, 0xffffffff
jne 0x42e246
lea ecx, [ebp - 0x24]
call fcn.00402fbc
xor al, al
jmp 0x42e363
push ebx
push 0x44763c
lea ecx, [ebp - 0x3c]
call fcn.00402f56
lea ecx, [ebp - 0x3c]
call fcn.0040331b
lea ecx, [ebp - 0x30]
call fcn.0040672f
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004039af
add esp, 0xc
test byte [ebp - 0x188], 0x10
jne 0x42e2e2
push dword [ebp - 0x18]
call fcn.0040679c
test al, al
pop ecx
je 0x42e2e2
push 0
lea ecx, [ebp - 0x30]
push dword [ebp - 0x18]
call fcn.004067d7
test al, al
je 0x42e2e2
lea ecx, [ebp - 0xc]
call fcn.00402ea1
lea eax, [ebp - 0xc]
push 1
push eax
lea ecx, [ebp - 0x30]
call fcn.00406855
test al, al
lea ecx, [ebp - 0xc]
je 0x42e2dd
call fcn.0040331b
push dword [ebp - 0x3c]
push dword [ebp - 0xc]
call fcn.004347b0
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
test al, al
jne 0x42e302
lea ecx, [ebp - 0xc]
call fcn.00402fbc
lea ecx, [ebp - 0x18]
call fcn.00402fbc
lea eax, [ebp - 0x188]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42e264
jmp 0x42e339
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004039af
add esp, 0xc
mov ecx, esi
push eax
call fcn.00403163
lea ecx, [ebp - 0x48]
call fcn.00402fbc
lea ecx, [ebp - 0xc]
call fcn.00402fbc
lea ecx, [ebp - 0x18]
call fcn.00402fbc
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebx, ebx
lea ecx, [ebp - 0x30]
cmp dword [esi + 4], ebx
setg bl
call fcn.00406776
lea ecx, [ebp - 0x3c]
call fcn.00402fbc
lea ecx, [ebp - 0x24]
call fcn.00402fbc
mov al, bl
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x42e369
Capabilities:
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov al, byte [ebp + 0x14]
push esi
cmp byte [ebp + 0x10], al
je 0x42e455
test al, al
je 0x42e44c
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push dword [0x443c9c]
push MenuHelp
push eax
call fcn.0040bd10
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.0040672f
push dword [0x44763c]
lea ecx, [ebp - 0xc]
call fcn.004068e6
mov esi, 0xb3
push esi
call fcn.00420134
pop ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.004068c3
cmp dword [ebp + 0x18], 0
je 0x42e3da
push dword [ebp + 0x18]
lea ecx, [ebp - 0xc]
call fcn.00406909
push str..lnk
push esi
call fcn.00420134
pop ecx
push eax
lea eax, [ebp - 0x18]
push 0x4400e4
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004039af
add esp, 0xc
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004039af
add esp, 0xc
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004039af
add esp, 0xc
lea ecx, [ebp - 0xc]
push 1
push dword [eax]
call fcn.00406816
lea ecx, [ebp - 0x24]
call fcn.00402fbc
lea ecx, [ebp - 0x30]
call fcn.00402fbc
lea ecx, [ebp - 0x3c]
call fcn.00402fbc
lea ecx, [ebp - 0xc]
call fcn.00406776
lea ecx, [ebp - 0x18]
call fcn.00402fbc
jmp 0x42e455
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
leave
ret 0x14

Function at 0x42e830
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
push 0x440638
call fcn.00402ebe
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004039af
add esp, 0xc
lea ecx, [ebp + 8]
push ecx
push dword [eax]
push MenuHelp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ebx, eax
lea ecx, [ebp - 0xc]
neg ebx
sbb ebx, ebx
neg ebx
call fcn.00402fbc
lea ecx, [ebp - 0x18]
call fcn.00402fbc
test bl, bl
je 0x42e885
xor al, al
jmp 0x42e8b9
push esi
push dword [ebp + 0xc]
call fcn.004345e0
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push 0x447348
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebx
leave
ret
Function at 0x42e8bc
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
push 0x440638
lea ecx, [ebp - 0x1c]
call fcn.00402ebe
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.004034ca
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0x2001b
push ebx
push dword [ebp - 0x1c]
push MenuHelp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x42e96c
lea eax, [ebp - 0xc]
push 1
push eax
push 1
push ebx
push 0x447348
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x62
mov edi, eax
pop eax
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x103
xor ecx, ecx
push ebx
cmp eax, esi
push ebx
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x80]
push eax
push 1
push dword [ebp - 8]
setne cl
mov byte [ebp + 8], cl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push dword [ebp - 8]
xor ecx, ecx
cmp eax, esi
setne cl
mov byte [ebp - 1], cl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x42e978
lea ecx, [ebp - 0x1c]
call fcn.00402fbc
xor al, al
jmp 0x42e99a
cmp byte [ebp + 8], bl
jne 0x42e990
cmp byte [ebp - 1], bl
jne 0x42e990
push dword [ebp - 0x1c]
push MenuHelp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x1c]
call fcn.00402fbc
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e99f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
push eax
push 0x20019
push 0
push dword [ebp + 8]
push MenuHelp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e9e1
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push esi
push eax
push 0
push 0x447348
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42e9e5
xor al, al
jmp 0x42e9f5
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp byte [esi], al
setne al
pop esi
leave
ret