joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f340
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b817f
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x48], eax
mov dword [eax + 0x10], 0
jb 0x42f3a1
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], eax
popal
cmp dword [ebp - 0x38], 5
jl 0x42f49c
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42f404
lea ecx, [ebp - 0x34]
push ecx
call eax
jmp 0x42f40e
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x34]
cmp ax, 9
je 0x42f423
cmp ax, 6
mov eax, 0x20
jne 0x42f428
mov eax, 0x40
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x60]
push dword [ebp - 0x38]
push str.w_02d_02dx_d
push eax
call fcn.00434a70
add esp, 0x14
mov esi, eax
mov ebx, dword [ebp - 0x40]
cmp ebx, esi
je 0x42f483
mov eax, dword [ebx + 0x14]
cmp eax, 8
jb 0x42f45c
inc eax
mov ecx, ebx
push eax
push dword [ebx]
call fcn.00423720
mov dword [ebx + 0x14], 7
cmp dword [ebx + 0x14], 8
mov dword [ebx + 0x10], 0
jb 0x42f474
mov eax, dword [ebx]
jmp 0x42f476
mov eax, ebx
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push esi
call fcn.004230a0
mov ecx, dword [ebp - 0x4c]
cmp ecx, 8
jb 0x42f498
inc ecx
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
call fcn.00423720
mov eax, ebx
jmp 0x42f49f
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057282e
mov esp, ebp
pop ebp
ret
Function at 0x431760
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x43176b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x431827
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
sub edi, 1
jne 0x431780
pop edi
test esi, esi
je 0x43184a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
sub esi, 1
jne 0x431830
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x431f60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x431fa6
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x431fa1
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x431fce
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x431fb7
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.0058bca0
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0057282e
mov esp, ebp
pop ebp
ret
Function at 0x431ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x432035
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x432030
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x432062
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x432046
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.0058bca0
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x432080
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057282e
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x43206d
cmp byte [esi + 8], 0
je 0x43206d
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057282e
mov esp, ebp
pop ebp
ret
Function at 0x432140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x432189
cmp byte [edi + 1], 0
je 0x432177
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x43218f
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057282e
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x4321b2
cmp byte [edi + 1], 0
je 0x4321ab
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x4321b5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4321c4
mov eax, dword [edi + 0x1c]
mov ebx, 0xffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
cmp eax, ebx
jae 0x4321c9
mov ebx, eax
mov dword [ebp - 0x18], eax
push esi
push 0x404
call fcn.0058f7d9
mov esi, eax
add esp, 4
test esi, esi
jne 0x4321f1
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057282e
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0xc], 0xffffffff
cmp ebx, eax
jbe 0x4322e9
mov edx, dword [ebp - 0x10]
add eax, 0x400
cmp eax, ebx
mov ecx, eax
mov eax, 0x404
cmova ecx, ebx
sub edx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x404
mov dword [ebp - 0x1c], edx
mov ebx, ecx
cmova ebx, eax
cmp byte [edi], 0
je 0x432250
cmp byte [edi + 1], 0
je 0x4322e9
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x432253
mov dword [edi + 0x1c], edx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x14], ebx
je 0x43227b
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x432276
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x4322a4
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x43228e
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x14], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.0058bca0
mov eax, dword [ebp - 0x14]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x4322e9
lea eax, [ebx - 3]
test eax, eax
js 0x4322d4
dec eax
cmp byte [eax + esi], 0x50
jne 0x4322d0
cmp byte [eax + esi + 1], 0x4b
jne 0x4322d0
cmp byte [eax + esi + 2], 5
jne 0x4322d0
cmp byte [eax + esi + 3], 6
je 0x432306
test eax, eax
jns 0x4322b4
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4322e9
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x18]
cmp eax, ebx
jb 0x432205
push esi
call fcn.0058f7d4
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.0057282e
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x4322d7
Function at 0x432cd0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
jne 0x432ceb
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x18], 0
je 0x432ce0
cmp dword [edi + 0x7c], 0
je 0x432cfc
call fcn.00433140
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.00432a40
add esp, 8
test eax, eax
je 0x432d20
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.0058f7d9
mov esi, eax
add esp, 4
test esi, esi
je 0x432d63
push 0x4000
call fcn.0058f7d9
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x432d6f
push esi
call fcn.0058f7d4
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x432dca
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00431a60
test eax, eax
jne 0x432dca
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x432ded
mov al, byte [edi + 0x39]
jmp 0x432df0
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x432e6e
nop
mov al, byte [ebx]
test al, al
je 0x432e6e
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, dword [esi + 0x70]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x619d20]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x619d20]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x432e20
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4332e3
cmp dword [esi + 4], 0xffffffff
jne 0x4332e3
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433272
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x4332a6
cmp eax, 0x2f
je 0x4332a6
push 0x61c740
push 0x104
push edi
call fcn.00592c7c
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00431ec0
add esp, 8
pop edi
test eax, eax
jne 0x4332c5
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.00432310
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433920
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x433952
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x433952
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x433a13
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x43396f
cmp ax, 0x5c
jne 0x433971
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x433963
cmp esi, ebx
je 0x4339ba
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.0058bca0
add esp, 0xc
cmp esi, 0x208
jae 0x433a23
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, edi
mov word [ebp + esi - 0x414], ax
call fcn.00433920
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x4339dd
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00592cf1
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00592c7c
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x433a13
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0057282e
mov esp, ebp
pop ebp
ret
call fcn.00572e91
int3
Function at 0x435c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b8586
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
jb 0x435c55
mov eax, dword [eax]
lea edx, [ebp - 0x38]
push edx
push 0x20019
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x435c74
xor al, al
jmp 0x435e01
lea eax, [ebp - 0x34]
mov dword [edi], 0
push eax
push 0
lea eax, [ebp - 0x30]
mov byte [ebp - 0x29], 0
push eax
push 0
mov ecx, ebx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
call fcn.00421f60
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x435cb8
test eax, eax
jne 0x435df5
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0057283f
mov ecx, dword [ebp - 0x34]
add esp, 4
mov ebx, eax
test ecx, ecx
je 0x435ced
xor eax, eax
mov edi, ebx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x34]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
push 0
call fcn.00421f60
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x435de6
mov eax, dword [ebp - 0x30]
cmp eax, 1
jne 0x435d52
cmp word [ebx], 0
jne 0x435d30
xor ecx, ecx
push ecx
push ebx
mov ecx, esi
call fcn.00423580
jmp 0x435ddd
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435d35
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, esi
call fcn.00423580
jmp 0x435ddd
cmp eax, 7
je 0x435d60
cmp eax, 2
jne 0x435de0
mov eax, dword [ebp - 0x34]
xor ecx, ecx
inc eax
mov word [ebp - 0x28], cx
shr eax, 1
lea ecx, [ebp - 0x28]
push eax
push ebx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
call fcn.00423580
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x435dc8
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x435d9e
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00423720
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x435db6
mov eax, dword [esi]
jmp 0x435db8
mov eax, esi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.004230a0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x435ddd
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00423720
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
mov byte [ebp - 0x29], 1
test ebx, ebx
je 0x435df5
push 2
push ebx
call fcn.005728a3
add esp, 8
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057282e
mov esp, ebp
pop ebp
ret 0x14
Function at 0x435e20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x435e36
mov eax, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x2001b
push 0
push 0
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x435e5e
xor al, al
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x435e6c
mov ecx, dword [ecx]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x14], 8
jb 0x435e77
mov edx, dword [edx]
push ebx
lea eax, [eax*2 + 2]
mov bl, 1
push eax
push ecx
push 1
push 0
push edx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x436360
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b86af
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x60], 0
xor eax, eax
push 7
push str.Desktop
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00423580
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x40
xor eax, eax
mov dword [ebp - 0x14], 7
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00423580
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], reloc.WS2_32.dll_accept
push eax
lea edx, [ebp - 0x5c]
mov ecx, esi
call fcn.004361e0
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x60], 1
cmp eax, 8
jb 0x436429
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00423720
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x436455
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00423720
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [esi + 0x10], eax
jne 0x4364d0
mov edx, 0x5be890
lea ecx, [ebp - 0x58]
call fcn.00436120
mov edi, eax
cmp esi, edi
je 0x4364bb
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x436494
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00423720
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4364ac
mov eax, dword [esi]
jmp 0x4364ae
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.004230a0
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x4364d0
inc ecx
push ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.00423720
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057282e
mov esp, ebp
pop ebp
ret
Function at 0x4364f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b86af
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x63406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x60], 0
xor eax, eax
push 8
push str.Programs
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00423580
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x40
xor eax, eax
mov dword [ebp - 0x14], 7
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00423580
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], reloc.WS2_32.dll_accept
push eax
lea edx, [ebp - 0x5c]
mov ecx, esi
call fcn.004361e0
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x60], 1
cmp eax, 8
jb 0x4365b9
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00423720
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x4365e5
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00423720
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [esi + 0x10], eax
jne 0x436660
mov edx, 0x5be8a0
lea ecx, [ebp - 0x58]
call fcn.00436120
mov edi, eax
cmp esi, edi
je 0x43664b
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x436624
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00423720
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x43663c
mov eax, dword [esi]
jmp 0x43663e
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.004230a0
mov ecx, dword [ebp - 0x44]
cmp ecx, 8
jb 0x436660
inc ecx
push ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.00423720
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057282e
mov esp, ebp
pop ebp
ret
Function at 0x436680
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b86f9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x63406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4366d8
mov eax, dword [esi]
jmp 0x4366da
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x10], 1
cmp ecx, 0x104
jb 0x43671b
mov dword [esi + 0x10], 0x104
cmp dword [esi + 0x14], 8
jb 0x43670e
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x208], cx
jmp 0x43672c
mov eax, esi
xor ecx, ecx
mov word [eax + 0x208], cx
jmp 0x43672c
mov eax, 0x104
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00434f30
cmp dword [esi + 0x14], 8
jb 0x436736
mov eax, dword [esi]
jmp 0x436738
mov eax, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esi + 0x10]
cmp eax, ecx
ja 0x436788
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x43676e
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00434f30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret