joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428ef0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0x58
xor esi, esi
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0047e7d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
push ebx
lea esi, [ebp - 0x64]
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.004576e7
add esp, 0x10
mov edx, edi
mov ecx, esi
call fcn.00428f56
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0047b9fe
leave
ret
Function at 0x429573
Capabilities:
Read file via mapping

Disassembly:
push esi
push 8
push 0
push 0
push 4
push dword [esp + 0x18]
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x429597
mov esi, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, esi
pop esi
ret 4

Function at 0x42a03f
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x208
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov ebx, ecx
mov dword [ebp - 0x7c], edi
mov word [ebp + 0x194], di
call fcn.0047e7d0
push esi
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0047e7d0
add esp, 0x18
cmp ebx, edi
mov dword [ebp - 0x80], edi
jne 0x42a09f
xor ebx, ebx
inc ebx
jmp 0x42a1c1
push str.HKEY_CLASSES_ROOT
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a0b7
mov esi, closesocket
jmp 0x42a120
push 0x4b9494
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a0cf
mov esi, getsockname
jmp 0x42a120
push str.HKEY_CURRENT_USER
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a0e7
mov esi, reloc.WS2_32.dll_accept
jmp 0x42a120
push str.HKEY_LOCAL_MACHINE
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a106
mov dword [ebp - 0x80], 1
mov esi, reloc.WS2_32.dll_bind
jmp 0x42a120
push str.HKEY_USERS
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a1a6
mov esi, reloc.WS2_32.dll_closesocket
push 0x5c
push ebx
call fcn.0047d56b
inc eax
inc eax
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.00402e8c
lea eax, [ebp + 0x194]
push 0x5c
push eax
call fcn.0047ebd0
push 0x5c
push ebx
mov word [eax], di
call fcn.0047ebd0
inc eax
inc eax
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00402e8c
add esp, 0x28
cmp dword [ebp - 0x80], edi
je 0x42a169
call fcn.00428e38
push edi
lea eax, [ebp - 0x7c]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
lea eax, [ebp + 0x194]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x42a1a2
push 4
lea eax, [ebp + 0x3ac]
push eax
push 4
push edi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x42a1a9
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x7c], edi
je 0x42a1b7
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80], edi
je 0x42a1c1
call fcn.00428e69
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0047b9fe
add ebp, 0x3a4
leave
ret
Function at 0x42a1db
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0x3ac], eax
mov eax, dword [ebp + 0x3b8]
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x208
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x1a2]
push edi
push eax
mov ebx, ecx
mov dword [ebp - 0x70], edi
mov word [ebp + 0x1a0], di
call fcn.0047e7d0
push esi
lea eax, [ebp - 0x6a]
push edi
push eax
mov word [ebp - 0x6c], di
call fcn.0047e7d0
add esp, 0x18
cmp dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
jne 0x42a24b
xor esi, esi
inc esi
jmp 0x42a384
push str.HKEY_CLASSES_ROOT
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a263
mov esi, closesocket
jmp 0x42a2cc
push 0x4b9494
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a27b
mov esi, getsockname
jmp 0x42a2cc
push str.HKEY_CURRENT_USER
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a293
mov esi, reloc.WS2_32.dll_accept
jmp 0x42a2cc
push str.HKEY_LOCAL_MACHINE
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a2b2
mov dword [ebp - 0x74], 1
mov esi, reloc.WS2_32.dll_bind
jmp 0x42a2cc
push str.HKEY_USERS
push ebx
call fcn.0047eb40
cmp eax, ebx
pop ecx
pop ecx
jne 0x42a369
mov esi, reloc.WS2_32.dll_closesocket
push 0x5c
push ebx
call fcn.0047d56b
inc eax
inc eax
push eax
lea eax, [ebp + 0x1a0]
push eax
call fcn.00402e8c
lea eax, [ebp + 0x1a0]
push 0x5c
push eax
call fcn.0047ebd0
push 0x5c
push ebx
mov word [eax], di
call fcn.0047ebd0
inc eax
inc eax
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00402e8c
add esp, 0x28
cmp dword [ebp - 0x74], edi
je 0x42a315
call fcn.00428e38
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
lea eax, [ebp + 0x1a0]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x42a357
push 4
pop ebx
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x42a35b
mov esi, eax
jmp 0x42a36c
mov esi, dword [ebp - 0x78]
sub esi, ebx
neg esi
sbb esi, esi
and esi, 2
jmp 0x42a36c
xor esi, esi
inc esi
cmp dword [ebp - 0x70], edi
je 0x42a37a
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x74], edi
je 0x42a384
call fcn.00428e69
mov ecx, dword [ebp + 0x3ac]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047b9fe
add ebp, 0x3b0
leave
ret
Function at 0x42c8bb
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 8], 0xffffffff
push ebx
push esi
push edi
mov ebx, eax
push dword [ebx + 0x14]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42ca13
mov eax, dword [ebx + 0x14]
push esi
push 0x80
push 3
push esi
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x42ca37
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
je 0x42ca13
cmp dword [ebx + 0x18], esi
je 0x42c983
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045d840
cmp eax, esi
mov ebx, dword [ebp + 8]
pop ecx
mov dword [ebx], eax
je 0x42ca1a
lea ecx, [edi + edi + 2]
push ecx
push esi
push eax
call fcn.0047e7d0
add esp, 0xc
push esi
push esi
push 2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x42ca1a
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebx]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x42ca0f
lea ebx, [edi + 1]
push ebx
call fcn.0045d840
cmp eax, esi
pop ecx
mov dword [ebp - 4], eax
je 0x42ca1a
push ebx
push esi
push eax
call fcn.0047e7d0
add esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ca1a
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push esi
push 0xffffffffffffffff
push dword [ebp - 4]
push esi
push esi
call ebx
mov edi, eax
cmp edi, esi
je 0x42ca1a
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045d840
cmp eax, esi
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
je 0x42ca1a
lea ecx, [edi + edi + 2]
push ecx
push esi
push eax
call fcn.0047e7d0
mov eax, dword [ebp + 8]
add esp, 0xc
push edi
push dword [eax]
push 0xffffffffffffffff
push dword [ebp - 4]
push esi
push esi
call ebx
test eax, eax
je 0x42ca1a
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0xffffffff
je 0x42ca29
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x42ca37
push dword [ebp - 4]
call fcn.0045d845
pop ecx
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42cc15
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push dword [ebp + 8]
xor eax, eax
mov byte [ebp - 4], bl
lea edi, [ebp - 3]
stosb byte es:[edi], al
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42cc82
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 2
jb 0x42cc7b
push ebx
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42cc7b
cmp byte [ebp - 4], 0xff
jne 0x42cc7b
cmp byte [ebp - 3], 0xfe
jne 0x42cc7b
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x42e274
Capabilities:
Enumerate network shares

Disassembly:
push 0x20
mov eax, 0x49f336
call fcn.00481d3a
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x42e28e
xor eax, eax
jmp 0x42e37a
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x14]
xor edi, edi
push ebx
inc edi
push edi
push 2
mov dword [ebp - 0x24], 0x3e80
mov dword [ebp - 0x14], ebx
call sub.MPR.dll_WNetOpenEnumW
cmp eax, ebx
mov dword [ebp - 0x20], eax
jne 0x42e367
push dword [ebp - 0x24]
call fcn.0045d840
pop ecx
lea ecx, [ebp - 0x24]
push ecx
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call sub.MPR.dll_WNetEnumResourceW
cmp eax, ebx
mov dword [ebp - 0x20], eax
jne 0x42e359
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 4
pop edx
mov dword [esi + 0x10], eax
mul edx
seto cl
mov dword [esi + 4], edi
neg ecx
or ecx, eax
push ecx
call fcn.0045d840
mov ecx, dword [esi + 0x10]
shl ecx, 2
push ecx
push ebx
push eax
mov dword [esi + 0xc], eax
call fcn.0047e7d0
add esp, 0x10
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], ebx
jbe 0x42e359
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
push 0x18
call fcn.0045d815
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x42e33d
mov ebx, dword [ebp - 0x18]
mov edi, eax
call fcn.0042e10c
xor ebx, ebx
jmp 0x42e33f
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
mov edx, dword [esi + 0xc]
add dword [ebp - 0x18], 0x20
mov dword [edx + ecx*4], eax
inc ecx
cmp ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
jb 0x42e31d
cmp dword [ebp - 0x1c], ebx
je 0x42e367
push dword [ebp - 0x1c]
call fcn.0045d845
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x42e377
push dword [ebp - 0x14]
call sub.MPR.dll_WNetCloseEnum
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
call fcn.00481e12
ret
Function at 0x42e497
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2b8], 0
push 0x2b0
lea eax, [ebp - 0x2b4]
push 0
push eax
call fcn.0047e7d0
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x2b8]
push 0x2b4
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x42e4eb
mov eax, dword [ebp - 0x2b4]
jmp 0x42e4ee
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047b9fe
leave
ret

Function at 0x42e96a
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x49e339
call fcn.00481d3a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42e9ac
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x42e9ac
push esi
lea ecx, [ebp - 0x10]
call fcn.00401640
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00402a47
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
push esi
call fcn.00481626
pop ecx
call fcn.00481e12
ret

Function at 0x42f4b6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
call fcn.00432e77
dec eax
cmp eax, 3
ja 0x42f4d0
or eax, 0xffffffff
jmp 0x42f567
push ebx
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x42f564
cmp dword [esi], ebx
jne 0x42f564
xor eax, eax
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 8]
push str.SHChangeNotifyRegister
stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
call fcn.0042f499
test eax, eax
jne 0x42f509
push 2
call fcn.0042f499
test eax, eax
je 0x42f55d
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x42f55d
lea eax, [ebp - 4]
push eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x42f55d
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
xor eax, eax
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push 0x4fe
push closesocket
push 0xff
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
cmp dword [ebp - 4], ebx
mov dword [esi + 4], eax
je 0x42f558
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [esi + 4], ebx
jne 0x42f562
or eax, 0xffffffff
jmp 0x42f566
mov dword [esi], edi
xor eax, eax
pop ebx
pop edi
leave
ret 4
Function at 0x432e77
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x118
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0x74], eax
mov eax, dword [0x4f00b8]
test eax, eax
jne 0x432f4b
push 0x114
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0047e7d0
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x432ed1
and dword [0x4f00b8], eax
jmp 0x432f4b
cmp dword [ebp - 0x90], 0
jne 0x432ee4
xor eax, eax
inc eax
mov dword [0x4f00b8], eax
jmp 0x432f4b
push 2
pop ecx
cmp dword [ebp - 0x90], ecx
jne 0x432f22
cmp dword [ebp - 0x9c], 4
jne 0x432efd
push 6
pop eax
jmp 0x432edd
push 5
pop eax
cmp dword [ebp - 0x9c], eax
jne 0x432edd
cmp dword [ebp - 0x98], 0
jne 0x432f15
push 7
jmp 0x432efa
cmp dword [ebp - 0x98], 1
jne 0x432edd
push 8
jmp 0x432efa
push 4
pop eax
cmp dword [ebp - 0x9c], eax
jne 0x432f43
cmp dword [ebp - 0x98], 0xa
jne 0x432f3a
push 3
jmp 0x432efa
cmp dword [ebp - 0x98], 0x5a
je 0x432edd
mov dword [0x4f00b8], ecx
mov eax, ecx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0047b9fe
add ebp, 0x78
leave
ret

Function at 0x433ad5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
je 0x433b24
push edi
push esi
push 0x80
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x433b23
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x433b1c
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x433d0f
Capabilities:
Check if file exists
Get file size
Read file on windows
Write file on windows

Disassembly:
push 0x28
mov eax, 0x4a11eb
call fcn.00481d6d
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], esi
je 0x433ec1
cmp dword [ebp + 0xc], esi
je 0x433ec1
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x433ebc
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push 0x80
push 3
push esi
push 1
push closesocket
push dword [ebp + 0xc]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x433e94
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x433e94
push edi
call fcn.0047dc09
cmp eax, esi
pop ecx
mov dword [ebp - 0x24], eax
je 0x433e94
push esi
lea ecx, [ebp - 0x28]
push ecx
push edi
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
mov eax, 0x100000
cmp ecx, eax
mov dword [ebp - 0x18], eax
jb 0x433dba
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], esi
je 0x433dcb
push dword [ebp - 0x14]
call fcn.0047e8b5
pop ecx
mov eax, dword [ebp - 0x18]
push eax
mov dword [ebp - 0x2c], eax
call fcn.0047dc09
mov edx, eax
mov eax, dword [ebp - 0x24]
pop ecx
mov ecx, dword [ebp - 0x28]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x14], edx
call fcn.00458720
cmp eax, esi
jne 0x433e55
push dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401640
push 2
pop edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.00402a47
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401325
push esi
push 0x80
push edi
push esi
xor edi, edi
inc edi
push edi
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 0x30], esi
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
je 0x433e78
mov ebx, dword [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x30]
push ecx
push ebx
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x30], ebx
jne 0x433e78
mov dword [ebp - 0x34], edi
jmp 0x433e78
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x3200000
ja 0x433e78
cmp eax, 0xfffffffb
jne 0x433e78
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], eax
jmp 0x433dbd
cmp dword [ebp - 0x24], esi
je 0x433e86
push dword [ebp - 0x24]
call fcn.0047e8b5
pop ecx
cmp dword [ebp - 0x14], esi
je 0x433e94
push dword [ebp - 0x14]
call fcn.0047e8b5
pop ecx
cmp dword [ebp - 0x1c], esi
je 0x433ea8
cmp dword [ebp - 0x1c], 0xffffffff
je 0x433ea8
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], esi
je 0x433ebc
cmp dword [ebp - 0x20], 0xffffffff
je 0x433ebc
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
jmp 0x433ec3
xor eax, eax
call fcn.00481e12
ret
Function at 0x433ec9
Capabilities:
Check if file exists
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43400e
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
mov edi, 0x80
push edi
push 3
push ebx
push 3
push closesocket
push dword [ebp + 0xc]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x433ffa
push ebx
push edi
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x433fe6
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x100000
lea eax, [edi + 0x100000]
ja 0x433f4a
lea eax, [edi + edi]
push eax
mov dword [ebp - 0x18], eax
call fcn.0047dc09
pop ecx
push edi
mov dword [ebp - 8], eax
call fcn.0047dc09
cmp dword [ebp - 8], ebx
pop ecx
mov dword [ebp - 0x10], eax
je 0x433fca
cmp eax, ebx
je 0x433fd8
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [ebp - 0xc]
push ecx
push edi
mov dword [ebp - 0xc], ebx
push eax
jmp 0x433fba
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x433fc3
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004587a0
test eax, eax
pop ecx
jne 0x433fca
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x433f7c
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x10], ebx
je 0x433fd8
push dword [ebp - 0x10]
call fcn.0047e8b5
pop ecx
cmp dword [ebp - 8], ebx
je 0x433fe6
push dword [ebp - 8]
call fcn.0047e8b5
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x433ffa
cmp dword [ebp - 0x14], 0xffffffff
je 0x433ffa
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
je 0x43400e
cmp dword [ebp - 4], 0xffffffff
je 0x43400e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43470e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.0043536e
test eax, eax
je 0x4347b2
push esi
push edi
xor esi, esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20019
push 1
push esi
push esi
push str.SoftwareClassesCLSID1172D735_4377_458d_B1BA_075ED5DC08BC
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 4
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x434782
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push str.needreupdate
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434782
mov edi, dword [ebp - 8]
cmp dword [ebp - 4], esi
je 0x434790
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], esi
je 0x4347b0
push dword [0x4ef86c]
mov ecx, dword [0x4efc4c]
xor eax, eax
cmp edi, esi
sete al
push eax
call fcn.004348a7
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x435703
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x435735
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call fcn.004926b6
add esp, 0xc
test eax, eax
je 0x435735
cmp eax, 0xffffffff
je 0x43573a
add esi, eax
cmp esi, dword [ebp + 0x10]
jb 0x43570e
mov eax, esi
pop esi
pop ebp
ret
or eax, 0xffffffff
jmp 0x435737
Function at 0x435ecb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x435ee4
mov eax, dword [ebp - 4]
jmp 0x435fbe
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x435f99
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b50a0]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b50a0]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b50a0]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b50a0]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b50a0]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b50a0]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b50a0]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4b50a0]
dec ebp
jne 0x435f03
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x435fb5
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4b50a0]
dec ecx
jne 0x435fa3
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret