joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415050
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x134], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004041d8
xor eax, eax
push ebp
push 0x415243
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
test ebx, ebx
je 0x415222
mov eax, ebx
call fcn.00414ec4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41520d
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, ebx
mov edi, eax
test edi, edi
je 0x41520d
mov eax, dword [edi + 0x18]
dec eax
test eax, eax
jl 0x41520d
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x134]
mov edx, dword [edi + 0x20]
add edx, ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [edx + ecx*4]
add edx, ebx
call fcn.00403f44
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.00404134
jne 0x415201
mov eax, dword [edi + 0x24]
add eax, ebx
mov edx, dword [ebp - 0x10]
mov si, word [eax + edx*2]
movzx eax, si
mov edx, dword [edi + 0x1c]
add edx, ebx
mov edi, dword [edx + eax*4]
cmp byte [ebp - 5], 0
jne 0x415124
mov eax, dword [ebp - 0xc]
cmp edi, dword [eax + 0x50]
jbe 0x4151f4
add edi, ebx
mov dword [ebp - 0x24], edi
cmp dword [0x42f5e4], 0
je 0x415147
lea eax, [ebp - 0x24]
call dword [0x42f5e4]
test al, al
je 0x415147
mov esi, dword [ebp - 0x24]
jmp 0x41520d
xor edi, edi
push 0x104
lea eax, [ebp - 0x12d]
push eax
push ebx
call sub.kernel32.dll_GetModuleFileNameA_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x12d]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4151f4
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4151eb
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4151e2
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00414ffc
add eax, dword [ebp - 0x20]
mov edi, eax
mov edx, dword [edi + 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00414ffc
add eax, dword [ebp - 0x20]
movzx edx, si
mov edi, dword [eax + edx*4]
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle
mov edx, edi
mov eax, ebx
call fcn.00414f4c
mov esi, eax
jmp 0x41520d
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x4150cf
test esi, esi
jne 0x415222
mov eax, dword [ebp - 4]
call fcn.004041e8
push eax
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41524a
lea eax, [ebp - 0x134]
call fcn.00403d4c
lea eax, [ebp - 4]
call fcn.00403d4c
ret
Function at 0x418190
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
jne 0x41820c
cmp dword [esp + 0x10], 0x1000
jne 0x41820c
cmp dword [esp + 4], 0
je 0x41820c
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
test eax, eax
je 0x41820c
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x41820c
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x41820c
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41af10
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x41afc7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, 0x41afe0
call fcn.00414818
push dword [ebp - 0xc]
push 0x41aff4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov cl, byte [ebp - 1]
mov eax, 0x41b000
call fcn.0041add4
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004040a8
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.004041e8
push eax
call fcn.0041ace4
mov esi, eax
test esi, esi
je 0x41afac
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
test eax, eax
je 0x41afa6
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41afce
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403d70
ret

Function at 0x41b258
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor esi, esi
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x41b2c9
mov ebx, 0x5f040000
jmp 0x41b2b7
cmp dword [esp + 0x10], 0x10000
jne 0x41b295
push 0x40
push 0x2000
push edi
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
jmp 0x41b2c9
cmp dword [esp + 0xc], 0x10000
jae 0x41b2a9
mov dword [esp + 0xc], 0x10000
jmp 0x41b2b1
and dword [esp + 0xc], 0xffff0000
mov eax, dword [esp + 0xc]
add ebx, eax
push 0x1c
lea eax, [esp + 4]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
je 0x41b275
push 0x40
push 0x1000
push edi
push esi
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, esi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x41b430
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x42fe68]
cmp eax, 0x1c
jne 0x41b4ab
cmp dword [ebp - 0xc], 0x1000
jne 0x41b4a6
cmp dword [ebp - 0x18], 0
je 0x41b4a6
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x41b4a6
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x41b485
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x41b4ab
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x42fe38]
cmp eax, 0
je 0x41b4a6
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x42fe80]
add ebx, dword [ebp - 0x10]
jmp 0x41b447
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x41d88c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov byte [ebp - 1], 0
test ebx, ebx
je 0x41d9a1
mov eax, ebx
call fcn.00414ec4
mov esi, eax
test esi, esi
je 0x41d9a1
cmp ebx, edi
jae 0x41d9a1
mov eax, dword [esi + 0x50]
add eax, ebx
cmp eax, edi
jbe 0x41d9a1
push 0x104
lea eax, [ebp - 0x115]
push eax
push ebx
call sub.kernel32.dll_GetModuleFileNameA_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x115]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x41d9a1
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41d998
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41d98f
mov edx, edi
sub edx, ebx
mov eax, esi
call fcn.00414ffc
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.00414ec4
mov esi, eax
test esi, esi
je 0x41d986
cmp ebx, dword [esi + 0x50]
jae 0x41d986
mov eax, edi
mov ecx, eax
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10]
add edx, ebx
mov esi, edx
cmp ecx, dword [esi]
jne 0x41d981
add eax, 2
mov ax, word [eax]
add edx, 2
cmp ax, word [edx]
jne 0x41d981
xor eax, eax
jmp 0x41d983
mov al, 1
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ed18
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41eefd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 0x41ef18
call fcn.00418008
mov dword [0x4318ec], eax
xor edx, edx
mov eax, 0x41ef3c
call fcn.00418008
mov dword [0x4318f0], eax
lea eax, [ebp - 8]
mov edx, 5
call fcn.00404318
lea eax, [ebp - 8]
call fcn.00404240
mov byte [eax], 0x72
lea eax, [ebp - 8]
call fcn.00404240
mov byte [eax + 1], 0x64
lea eax, [ebp - 8]
call fcn.00404240
mov byte [eax + 2], 0x65
lea eax, [ebp - 8]
call fcn.00404240
mov byte [eax + 3], 0x63
lea eax, [ebp - 8]
call fcn.00404240
mov byte [eax + 4], 0x20
lea edx, [ebp - 0xc]
mov eax, 0x41ef64
call fcn.00414818
push dword [ebp - 0xc]
push 0x41ef74
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.004144ac
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004040a8
mov eax, dword [ebp - 8]
call fcn.004041e8
push eax
push 0
push 0
call fcn.00405e44
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x41eee2
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [0x4318e0], esi
mov dword [0x4318e4], edi
cmp dword [0x4318ec], 0
je 0x41ee34
cmp dword [0x4318f0], 0
jne 0x41eeb4
mov eax, 0x41ef80
call fcn.00418104
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x41eec6
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x41eec6
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x41eec6
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x41eec6
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x41eec6
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41eec6
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x4318e8], edx
mov edx, 0x41ecc8
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 4]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov bl, 1
jmp 0x41eec6
push 0x41ec74
push 1
call dword [0x4318ec]
test eax, eax
setne bl
test bl, bl
jne 0x41eee2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ef04
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403d70
ret
Function at 0x41ef9c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x4318ec], 0
je 0x41efb4
cmp dword [0x4318f0], 0
jne 0x41f00b
mov eax, 0x41f024
call fcn.00418104
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41eff1
mov eax, dword [0x4318e8]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x41f016
push 0x41ec74
call dword [0x4318f0]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x421394
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004041d8
xor eax, eax
push ebp
push 0x421454
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
setne bl
xor eax, eax
mov dword [ebp - 8], eax
test bl, bl
jne 0x42143e
cmp dword [ebp - 4], 0
jne 0x4213e1
lea edx, [ebp - 8]
mov eax, esi
call fcn.0042117c
test al, al
je 0x42143e
call sub.kernel32.dll_GetCurrentProcess
lea edx, [ebp - 0xc]
call fcn.0042117c
test al, al
je 0x42142f
cmp dword [ebp - 4], 0
je 0x42140f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x421426
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree_2
cmp dword [ebp - 8], 0
je 0x42143e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LocalFree_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42145b
lea eax, [ebp - 4]
call fcn.00403d4c
ret

Function at 0x421464
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x42150d
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov ebx, eax
push ebx
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov edi, eax
test edi, edi
je 0x421507
push 0
lea eax, [esp + 4]
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x421501
cmp ebx, dword [esp]
jne 0x421501
xor ebx, ebx
mov eax, dword [esp]
dec eax
shr eax, 1
test eax, eax
jl 0x4214eb
inc eax
xor edx, edx
movzx ecx, word [edi + edx*2]
add ebx, ecx
test ebx, 0xffff0000
je 0x4214e7
mov ecx, ebx
and ecx, 0xffff
shr ebx, 0x10
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4214ca
mov eax, ebx
and ax, 0xffff
shr ebx, 0x10
add ax, bx
movzx eax, ax
mov ebx, eax
mov ebp, dword [esp]
add ebp, ebx
push edi
call sub.kernel32.dll_LocalFree_2
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebp
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x421518
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4215f6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
push ebx
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
jne 0x421557
mov word [ebx], 0x2e
mov word [ebx + 2], 0
push ebx
call sub.kernel32.dll_lstrlenW
cmp word [ebx + eax*2 - 2], 0x5c
je 0x421570
push 0x421604
push ebx
call sub.kernel32.dll_lstrcatW
lea edx, [ebp - 0x44]
mov eax, 0x421610
call fcn.00414818
push dword [ebp - 0x44]
push 0x421620
lea edx, [ebp - 0x48]
mov eax, 0x42162c
call fcn.00414818
push dword [ebp - 0x48]
push 0x421640
lea edx, [ebp - 0x4c]
mov eax, 0x42164c
call fcn.00414818
push dword [ebp - 0x4c]
lea eax, [ebp - 4]
mov edx, 5
call fcn.004040a8
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 4]
call fcn.004041e8
push eax
call fcn.0041a3c4
lea eax, [ebp - 0x40]
push eax
push ebx
call sub.kernel32.dll_lstrcatW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4215fd
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00403d70
lea eax, [ebp - 4]
call fcn.00403d4c
ret

Function at 0x421650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041d8
xor eax, eax
push ebp
push 0x4216d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 4]
mov al, byte [ebx]
mov byte [ebp - 5], al
inc ebx
mov edx, dword [ebx]
mov eax, edi
call fcn.00404318
add ebx, 4
mov esi, dword [edi]
mov al, byte [ebx]
cmp al, byte [ebp - 5]
jne 0x4216ad
inc ebx
mov eax, ebx
inc eax
movzx eax, byte [eax]
test eax, eax
jle 0x4216a8
mov dl, byte [ebx]
xor dl, 0x55
mov byte [esi], dl
inc esi
dec eax
jne 0x42169d
add ebx, 2
jmp 0x4216b3
xor al, 0x55
mov byte [esi], al
inc esi
inc ebx
mov eax, dword [edi]
call fcn.00403fe8
add eax, dword [edi]
cmp eax, esi
ja 0x42168b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4216dd
lea eax, [ebp - 4]
call fcn.00403d4c
ret
Function at 0x42263c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004041d8
xor eax, eax
push ebp
push 0x422709
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004041e8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4226d9
xor ebx, ebx
jmp 0x4226b6
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00403fbc
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 8]
call fcn.0042263c
pop ecx
inc ebx
push 0x104
lea eax, [ebp - 0x10d]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x42268c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 4]
call fcn.004041e8
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422710
lea eax, [ebp - 0x114]
call fcn.00403d4c
lea eax, [ebp - 4]
call fcn.00403d4c
ret
Function at 0x4239b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
push ebp
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004236f4
pop ecx
test al, al
jne 0x423ad8
push 0x104
lea eax, [ebp - 0x111]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x104
lea eax, [ebp - 0x31c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
mov cl, 1
call fcn.004236f4
pop ecx
test al, al
jne 0x423ad8
push 0x104
lea eax, [ebp - 0x111]
push eax
mov eax, dword [0x431660]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x104
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [0x431660]
push eax
call sub.kernel32.dll_GetModuleFileNameW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
mov cl, 1
call fcn.004236f4
pop ecx
test al, al
jne 0x423ad8
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x31c]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
xor ecx, ecx
call fcn.004236f4
pop ecx
test al, al
jne 0x423ad8
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push 0x104
lea eax, [ebp - 0x31c]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
xor ecx, ecx
call fcn.004236f4
pop ecx
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4240ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 8], 0
je 0x424117
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
push ebx
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x42412b
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
jne 0x42412f
xor eax, eax
jmp 0x424131
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4242a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax], 0
je 0x424337
push 2
lea ecx, [ebp - 2]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004240c0
test al, al
je 0x424337
cmp word [ebp - 2], 0x5a4d
jne 0x424337
push 4
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004240c0
test al, al
je 0x424337
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004240c0
test al, al
je 0x424337
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp dword [eax], 0x4550
jne 0x424337
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
test byte [eax + 0x17], 0x20
je 0x42433b
xor eax, eax
jmp 0x42433d
mov al, 1
test al, al
je 0x42435a
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
movzx ecx, word [ebp - 2]
add edx, ecx
add edx, 0x78
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [ecx], edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x425f54
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov byte [ebp - 1], 0
push ebx
mov eax, dword [esi]
push eax
call fcn.00418dbc
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x149
push esi
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x4260a1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
mov eax, edi
add eax, 0x149
push eax
push ebx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x4260a1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
mov eax, edi
add eax, 0x149
mov edx, dword [ebp + 0xc]
add eax, dword [edx + 0xc]
push eax
push ebx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x4260a1
cmp dword [esi + 0x20], 0
je 0x42601d
lea eax, [ebp - 8]
push eax
push 5
lea eax, [ebp - 0x16]
push eax
mov eax, dword [esi + 0x20]
push eax
push ebx
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4260a1
lea eax, [ebp - 8]
push eax
push 5
lea eax, [ebp - 0x16]
push eax
lea eax, [edi + 0x24]
push eax
push ebx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x4260a1
mov byte [ebp - 1], 1
cmp dword [esi + 0x145], 0
je 0x4260a1
lea eax, [ebp - 8]
push eax
push 5
lea eax, [ebp - 0x16]
push eax
mov eax, dword [esi + 0x145]
dec eax
push eax
push ebx
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4260a1
cmp byte [ebp - 0x16], 0xe8
jne 0x4260a1
lea eax, [edi + 0x3c]
sub eax, dword [esi + 0x145]
sub eax, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
mov eax, dword [esi + 0x145]
push eax
push ebx
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x4260a1
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x145]
push eax
push ebx
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 4
mov eax, dword [esi + 0x145]
push eax
call sub.kernel32.dll_VirtualProtect
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8