joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4341d7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x7c
mov eax, 0x4787fa
call fcn.00448ddd
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push esi
call fcn.00433c44
xor ebx, ebx
cmp dword [ebp - 0x34], ebx
je 0x43426f
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x84]
push ebx
or eax, 0x20019
push eax
lea eax, [ebp - 0x44]
push eax
push dword [edi]
call fcn.00433c76
mov esi, dword [ebp - 0x84]
add esp, 0x10
cmp dword [ebp - 0x7c], ebx
je 0x434226
mov al, byte [ebp - 0x80]
jmp 0x43425b
push ebx
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x69], bl
push eax
mov al, byte [ebp - 0x80]
push ecx
push ecx
mov ecx, esp
mov byte [ecx + 4], al
lea eax, [ebp - 0x44]
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0x68]
push edi
call fcn.00433e12
mov ecx, eax
call fcn.004341d7
lea ecx, [ebp - 0x68]
mov bl, al
call fcn.00433f49
mov al, byte [ebp - 0x69]
mov dword [ebp - 4], 1
test al, al
je 0x434296
push esi
call fcn.00436b4f
pop ecx
jmp 0x434296
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
jb 0x43427d
mov esi, dword [esi]
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x434296
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.004049c7
lea ecx, [ebp - 0x44]
call fcn.004049c7
mov al, bl
call fcn.00448d87
ret 8
Function at 0x4345ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0xac
push 0xffffffffffffffff
push 0x4789b2
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4a8068]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 0xb4]
lea ecx, [ebp + 0x78]
mov edi, dword [ebp + 0xb8]
mov eax, dword [ebp + 0xbc]
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x20], eax
call fcn.00433c44
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x88], eax
je 0x43469c
push eax
lea eax, [ebp + 0x78]
push eax
push ebx
lea ecx, [ebp + 0x3c]
call fcn.00433eb1
push dword [ebp - 0x20]
lea ecx, [ebp + 0x90]
mov byte [ebp - 4], 1
push ecx
push esi
mov ecx, eax
call fcn.004345ff
lea ecx, [ebp + 0x3c]
call fcn.00433f49
jmp 0x434714
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 2
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp ecx, edx
cmove ecx, eax
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x4346c5
mov eax, dword [edi]
lea edx, [ebp - 0x1c]
push edx
push ecx
push dword [ebp - 0x20]
push 0
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
cmp ebx, 0xea
je 0x43474e
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
jne 0x43476b
test ebx, ebx
jne 0x43476f
test ecx, ecx
jne 0x434751
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00418eeb
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00418ebe
lea ecx, [ebp - 0x18]
call fcn.0040c03a
lea ecx, [ebp + 0x90]
call fcn.004049c7
lea ecx, [ebp + 0x78]
call fcn.004049c7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
call fcn.004484c4
add ebp, 0xac
leave
ret 0xc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00418eeb
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x24]
jmp 0x4346ad
test ebx, ebx
je 0x4346f5
push str.query_value
lea ecx, [ebp + 0x60]
call fcn.00403e12
lea ecx, [ebp]
call fcn.00403e3f
mov ecx, dword [ebp - 0x24]
push eax
push edi
lea eax, [ebp + 0x60]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.0043507c
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 5
call fcn.00426e87
push str.System_error
push ebx
mov byte [ebp - 4], 6
lea eax, [ebp - 0xd4]
push dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x30]
push eax
call fcn.00435e5f
mov edx, eax
push 0x12b
push str.Registry::getValue
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_Registry.cpp
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.00402dde
push eax
lea ecx, [ebp + 0x18]
call fcn.0041e178
lea eax, [ebp + 0x18]
mov dword [esp], 0x4a5da4
push eax
call fcn.0044c197
int3
Function at 0x434f39
Capabilities:
Delete registry value

Disassembly:
push 0x104
mov eax, 0x478b6f
call fcn.00448ddd
mov ebx, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push esi
call fcn.00433c44
cmp dword [ebp - 0x30], 0
je 0x434fd7
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x78]
push 0
or eax, 0x2001f
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebx]
call fcn.00433c76
mov edi, dword [ebp - 0x70]
add esp, 0x10
mov esi, dword [ebp - 0x78]
test edi, edi
je 0x434f87
mov al, byte [ebp - 0x74]
jmp 0x434fbc
push 0x4ab119
lea eax, [ebp - 0x28]
push eax
mov al, byte [ebp - 0x74]
push ecx
push ecx
mov ecx, esp
mov byte [ecx + 4], al
lea eax, [ebp - 0x40]
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0x64]
push ebx
call fcn.00433e12
mov ecx, eax
call fcn.00434f39
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.00433f49
xor eax, eax
mov dword [ebp - 4], 1
test al, al
je 0x435062
push esi
call fcn.00436b4f
pop ecx
jmp 0x435062
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x434fe1
mov eax, dword [esi]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
test edi, edi
jne 0x435062
cmp dword [0x4ac0bc], eax
jg 0x435062
push ecx
push ecx
lea ecx, [ebp - 0x110]
call fcn.00403ead
mov edx, str.Deleted__
lea ecx, [ebp - 0x110]
call fcn.00406a2a
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push esi
push eax
call fcn.00434128
lea ecx, [ebp - 0x110]
call fcn.00405461
mov esi, eax
mov edx, str.__value
mov ecx, esi
call fcn.00406a2a
push esi
push str.Registry::deleteValue
push 0x1d2
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_Registry.cpp
push edi
mov ecx, 0x4ac0bc
call fcn.00402d4b
lea ecx, [ebp - 0x110]
call fcn.00402bf1
lea ecx, [ebp - 0x28]
call fcn.004049c7
lea ecx, [ebp - 0x40]
call fcn.004049c7
mov eax, edi
call fcn.00448d87
ret 8
Function at 0x43631d
Capabilities:
Create thread

Disassembly:
push 0x70
mov eax, 0x478f1d
call fcn.00448ddd
mov edi, edx
mov esi, ecx
test edi, edi
jne 0x436339
or dword [esi], 0xffffffff
jmp 0x4363cb
xor ebx, ebx
mov dword [ebp - 0x58], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], ebx
call fcn.0043586d
mov byte [ebp - 4], 2
lea eax, [ebp - 0x54]
or dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44], edi
push eax
push 0x436302
push ebx
push ebx
mov dword [ebp - 0x40], ebx
call fcn.0045c366
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4363d3
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.00435a44
lea eax, [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4c]
push 1
mov dword [ebp - 0x40], edi
call fcn.0043575e
jmp 0x4363b0
push ecx
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ecx + 8]
call fcn.004355f1
cmp dword [ebp - 0x40], 0
jne 0x4363a0
lea ecx, [ebp - 0x70]
call fcn.00435a97
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x54]
mov dword [esi], eax
call fcn.004358bc
mov eax, esi
call fcn.00448d87
ret
lea ecx, [ebp - 0x7c]
call fcn.004355da
mov edx, eax
push 0x70
push str.ipc::Thread::start
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_ipc_windows_ThreadImpl.cpp
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.00402dde
push eax
lea ecx, [ebp - 0x38]
call fcn.00435908
lea eax, [ebp - 0x38]
mov dword [esp], 0x4a61f8
push eax
call fcn.0044c197
int3
Function at 0x43ae87
Capabilities:
Write file on windows

Disassembly:
push 0xe8
mov eax, 0x479f19
call fcn.00448ddd
mov esi, ecx
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
push ecx
push ecx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xf4], 0x4945f0
call fcn.00403ead
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xec]
mov eax, dword [ebp - 0xec]
push 0
mov eax, dword [eax + 4]
add ecx, eax
push dword [ecx + 0xc]
mov dword [ecx + 0x10], 6
call fcn.00402a26
mov dword [ebp - 4], 2
lea eax, [ebp - 0xf4]
push dword [esi + 4]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x30], eax
call fcn.0043fd86
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00404bca
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0043d7b4
cmp dword [ebp - 0x18], 0
jne 0x43af31
mov esi, 0x48abe4
push esi
call fcn.00451490
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00404a3c
push ecx
push ecx
mov edx, ebx
lea ecx, [ebp - 0x3c]
call fcn.0043d6db
pop ecx
pop ecx
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x44], edi
mov byte [ebp - 0x40], cl
mov byte [ebp - 4], 4
cmp byte [ebp - 0x38], 0
je 0x43af6b
cmp dword [ebp - 0x3c], 0
mov byte [ebp - 0x38], 0
je 0x43af6b
push dword [ebp - 0x3c]
call fcn.00456f3d
pop ecx
mov edx, ebx
test edi, edi
jne 0x43afe4
lea ecx, [ebp - 0x34]
call fcn.0043d694
mov cl, byte [eax + 4]
mov ebx, dword [eax]
mov byte [ebp - 0x29], cl
mov byte [eax + 4], 0
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x38], cl
mov byte [ebp - 4], 5
cmp byte [ebp - 0x30], 0
je 0x43afa8
cmp dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x30], 0
je 0x43afa8
push dword [ebp - 0x34]
call fcn.0045ae7f
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push 0x132
push esi
push eax
push ebx
call fcn.0045b721
add esp, 0xc
mov edx, esi
mov ecx, eax
call fcn.0043c152
cmp byte [ebp - 0x29], 0
pop ecx
je 0x43b050
cmp ebx, 0xffffffff
je 0x43b050
push ebx
call fcn.0045ae7f
pop ecx
jmp 0x43b050
lea eax, [ebp - 0x44]
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.0043d706
pop ecx
pop ecx
mov bl, byte [eax + 4]
mov esi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x38], bl
mov byte [ebp - 4], 6
cmp byte [ebp - 0x30], 0
je 0x43b01f
cmp dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 0
je 0x43b01f
push dword [ebp - 0x34]
call fcn.00456f3d
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.00457851
add esp, 0x10
cmp eax, 1
jne 0x43b07c
test bl, bl
je 0x43b04d
test esi, esi
je 0x43b04d
push esi
call fcn.00456f3d
pop ecx
mov edi, dword [ebp - 0x44]
cmp byte [ebp - 0x40], 0
je 0x43b061
test edi, edi
je 0x43b061
push edi
call fcn.00456f3d
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004049c7
lea ecx, [ebp - 0xec]
call fcn.00402bf1
call fcn.00448d87
ret 4
push 0x132
lea ecx, [ebp - 0x54]
call fcn.0041241e
push 0x4a5ce4
lea eax, [ebp - 0x54]
push eax
call fcn.0044c197
int3
Function at 0x43c856
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x47a2a0
call fcn.00448da9
mov eax, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
mov edx, 0x494578
mov ecx, eax
call fcn.0043f5e8
mov esi, eax
mov ecx, esi
call fcn.0043d9a5
pop ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push 0x100001
mov ecx, eax
call fcn.00425854
push esi
mov ebx, 0x100000
push ebx
push 1
push dword [ebp - 0x28]
call fcn.00457e47
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, ebx
ja 0x43c931
push esi
call fcn.0045c423
pop ecx
test eax, eax
je 0x43c8d6
push 0x133
jmp 0x43c936
push esi
call fcn.0045c3f7
pop ecx
test eax, eax
jne 0x43c8e8
push 0x13b
jmp 0x43c936
mov ebx, dword [ebp - 0x28]
mov ecx, ebx
mov edx, dword [ebp - 0x10]
call fcn.0043c822
mov ecx, dword [ebp - 0x10]
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebx + ecx]
cmp ebx, eax
je 0x43c916
push ecx
push ebx
mov ecx, edi
call fcn.00404a3c
lea ecx, [ebp - 0x28]
call fcn.0040c03a
test esi, esi
je 0x43c929
push esi
call fcn.00456f3d
pop ecx
mov eax, edi
call fcn.00448d72
ret
push 0xc8
lea ecx, [ebp - 0x38]
call fcn.0041241e
push 0x4a5ce4
lea eax, [ebp - 0x38]
push eax
call fcn.0044c197
int3
Function at 0x43d7b4
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x80]
sub esp, 0x80
push 0xffffffffffffffff
push 0x47a56d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4a8068]
xor eax, ebp
mov dword [ebp + 0x7c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ecx + 0x30], 0
je 0x43d939
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov dword [ebp - 4], eax
call fcn.0043d26d
mov edi, dword [ebp - 0x14]
mov eax, edi
mov ebx, dword [ebp - 0x18]
sub eax, ebx
push 0x18
cdq
pop ecx
idiv ecx
imul esi, eax, 0x18
add esi, ebx
jmp 0x43d82a
push esi
lea ecx, [esi - 0x18]
call fcn.00403dc5
add esi, 0x18
cmp esi, edi
jne 0x43d81e
add edi, 0xffffffe8
mov ecx, edi
call fcn.004049c7
mov dword [ebp - 0x14], edi
cmp ebx, edi
je 0x43d914
and dword [ebp + 0x74], 0
lea ecx, [ebp + 0x64]
and dword [ebp + 0x78], 0
lea esi, [ebx + 0x18]
push ebx
call fcn.00404b39
mov byte [ebp - 4], 1
jmp 0x43d904
push esi
mov edx, 0x48e79c
lea ecx, [ebp + 0x18]
call fcn.00409fb1
pop ecx
mov byte [ebp - 4], 2
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x43d87d
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp + 0x64]
call fcn.00404ae0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 1
call fcn.004049c7
lea eax, [ebp + 0x64]
push eax
lea ecx, [ebp + 0x30]
call fcn.0043d15d
mov byte [ebp - 4], 3
lea ecx, [ebp]
cmp dword [ebp + 0x5c], 8
lea eax, [ebp + 0x48]
push ecx
cmovae eax, dword [ebp + 0x48]
push eax
call fcn.0045d430
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x43d8ed
cmp dword [ebp + 0x5c], 8
lea eax, [ebp + 0x48]
cmovae eax, dword [ebp + 0x48]
push eax
call fcn.0045c9f8
pop ecx
cmp eax, 0xffffffff
jne 0x43d8ed
call fcn.00451cc1
push 0x137
push 0x11
pop ecx
mov edx, dword [eax]
call fcn.0043c152
pop ecx
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 1
call fcn.00419e55
lea ecx, [ebp + 0x30]
call fcn.004049c7
add esi, 0x18
cmp esi, edi
jne 0x43d860
lea ecx, [ebp + 0x64]
call fcn.004049c7
lea ecx, [ebp - 0x18]
call fcn.004139b1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7c]
xor ecx, ebp
call fcn.004484c4
sub ebp, 0xffffff80
leave
ret
push str.canonicalized_file_name_expected
lea ecx, [ebp - 0x18]
call fcn.00417fc1
push 0x4a5d20
lea eax, [ebp - 0x18]
push eax
call fcn.0044c197
int3
Function at 0x43fc90
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x47aa4c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4a8068]
xor eax, ebp
mov dword [ebp + 0x238], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [ebp + 0x30]
mov dword [ebp - 0x10], edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x43fd6a
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp]
call fcn.0041d1c7
mov esi, eax
mov dword [ebp - 4], ebx
mov ebx, str.OracleJavajava.settings.cfg
push ebx
call fcn.00451df6
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00426fc3
xor ecx, ecx
mov byte [ebp - 0x10], cl
push dword [ebp - 0x10]
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
lea ecx, [ebp + 0x18]
push eax
call fcn.0041d2a0
lea edx, [ebp + 0x18]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.0043f3d0
lea ecx, [ebp + 0x18]
call fcn.00419e55
lea ecx, [ebp]
call fcn.00419e55
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.004484c4
add ebp, 0x23c
leave
ret
push 0xc8
lea ecx, [ebp - 0x20]
call fcn.0041241e
push 0x4a5ce4
lea eax, [ebp - 0x20]
push eax
call fcn.0044c197
int3

Function at 0x44278c
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x24]
mov ebp, SysReAllocString
test edi, edi
jl 0x44280f
jg 0x4427b8
test esi, esi
je 0x44280f
test edi, edi
jg 0x4427b8
jl 0x4427b4
cmp esi, ebp
jae 0x4427b8
mov eax, esi
jmp 0x4427ba
mov eax, ebp
and dword [esp + 0x20], 0
cmp dword [esp + 0x18], 0xffffffff
je 0x442800
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4427ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x44280a
jmp 0x442800
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x4427fb
add ebx, eax
cdq
sub esi, eax
sbb edi, edx
jmp 0x4427a0
cmp eax, 0xffffffff
jne 0x44280a
call fcn.00451cc1
cmp dword [eax], 4
je 0x4427a0
or eax, 0xffffffff
jmp 0x442811
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x465a54
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004658ca

Function at 0x46855c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004684de
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x407ef8
mov ecx, 0x22de7d89
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x55b27d17
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x42a38c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, 0x42ccf0
mov esi, 0x42cd28
mov eax, dword [0x42c710]
mov dword [0x42cd18], eax
mov dword [ebx], 0xc0
mov dword [ebx + 4], 0x42a334
mov eax, dword [0x42cd18]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x1c], 0x10
mov eax, 0x42a48c
mov dword [ebx + 0x24], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebx + 0x18], eax
push ebx
call sub.user32.dll_RegisterClassA
test ax, ax
je 0x42a486
push 0
mov eax, dword [0x42cd18]
push eax
push 0
push 0
push 0xa
push 0xa
push 0
push 0
push 0xcc0000
push 0x42a490
push 0x42a48c
push pe_nt_image_headers32
call sub.user32.dll_CreateWindowExA
mov dword [0x42cd1c], eax
cmp dword [0x42cd1c], 0
je 0x42a486
call fcn.0040bd50
push 0x4281f4
push 0x5dc
push 1
mov eax, dword [0x42cd1c]
push eax
call sub.user32.dll_SetTimer
push 0x4297dc
push 0xea60
push 2
mov eax, dword [0x42cd1c]
push eax
call sub.user32.dll_SetTimer
push 0
mov eax, dword [0x42cd1c]
push eax
call sub.user32.dll_ShowWindow
jmp 0x42a46d
push esi
call sub.user32.dll_TranslateMessage
push esi
call sub.user32.dll_DispatchMessageA
push 0
push 0
mov eax, dword [0x42cd1c]
push eax
push esi
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x42a461
call fcn.0040bea8
pop esi
pop ebx
ret

Function at 0x438c1e
Capabilities:
Copy file
Create process on windows
Persist via run registry key

Disassembly:
mov eax, 0x38c1e
mov ebx, 0x38c9d
call fcn.00438c32
jmp fcn.0042a608
Function at 0x53fdf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd7000]
push edi
or ebp, 0xffffffff
jmp 0x53fe12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53fe19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fe08
mov eax, 1
add ebx, ebx
jne 0x53fe2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53fe3c
jne 0x53fe4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53fe4c
dec eax
add ebx, ebx
jne 0x53fe48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53fe20
xor ecx, ecx
sub eax, 3
jb 0x53fe64
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53fed6
sar eax, 1
mov ebp, eax
jmp 0x53fe6f
add ebx, ebx
jne 0x53fe6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x53fe7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x53fea0
inc ecx
add ebx, ebx
jne 0x53fe8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53fe81
jne 0x53fe9d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53fe81
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53fec0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53feb1
jmp 0x53fe0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53fec0
add edi, ecx
jmp 0x53fe0e
pop esi
mov edi, esi
mov ecx, 0x39e0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53fede
cmp byte [edi], 0x28
jne 0x53fede
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x53fee3
lea edi, [esi + 0x13c000]
mov eax, dword [edi]
or eax, eax
je 0x53ff5b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1410b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1411f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53ff10
mov ecx, edi
jns 0x53ff3f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1411f8]
or eax, eax
je 0x53ff55
mov dword [ebx], eax
add ebx, 4
jmp 0x53ff2d
call dword [esi + 0x1411fc]
popal
jmp 0x422c92