joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437546
Capabilities:
Parse credit card information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x92], 0
jne 0x43755e
test byte [ecx + 0xb], 0xf
jne 0x43755e
pop ebp
jmp fcn.0043744e
pop ebp
jmp fcn.00436312

Function at 0x4377b9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.00404073
cmp dword [ebp - 4], edi
je 0x43785e
push esi
mov esi, dword [ebp + 0xc]
cmp esi, edi
mov dword [ebp - 0xc], edi
jne 0x4377f6
lea esi, [ebp - 0xc]
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
cmp ebx, edi
setne cl
mov dword [esi], eax
cmp ecx, edi
mov dword [ebp - 8], ecx
je 0x43782c
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [ebx], eax
je 0x43785c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x437833
mov ebx, eax
call fcn.0042df50
mov ebx, eax
cmp ebx, edi
je 0x43785c
push edi
lea eax, [ebp - 0x10]
push eax
push dword [esi]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], edi
je 0x43785a
mov eax, dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, ebx
pop ebx
pop esi
lea ecx, [ebp - 4]
call fcn.00402abc
mov eax, edi
pop edi
leave
ret
Function at 0x437c9d
Capabilities:
Delete file
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 4], esi
mov dword [ebp - 4], esi
jg 0x437cbc
xor eax, eax
jmp 0x437e80
push 0x49b604
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0042c536
lea ecx, [ebp - 0xc]
call fcn.00402a81
push dword [edi + 4]
push dword [edi]
call fcn.0042c5a3
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x437cfb
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edi
call dword [eax + 0xc]
cmp dword [ebp - 4], esi
jne 0x437d00
mov eax, dword [edi]
push edi
call dword [eax + 8]
cmp dword [ebp - 4], esi
je 0x437d1a
mov eax, dword [0x49b1b4]
cmp eax, esi
mov edi, dword [ebp - 4]
je 0x437d13
cmp dword [ebp - 0xc], esi
jne 0x437d13
call eax
mov esi, edi
jmp 0x437e73
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x2e4]
push eax
push 0x484e0c
mov word [ebp - 0x2e4], si
call edi
cmp eax, esi
jg 0x437d70
push ebx
lea eax, [ebp - 0x2e4]
push eax
push 0x484e00
call edi
cmp eax, esi
jg 0x437d70
mov eax, dword [0x49b1b4]
cmp eax, esi
je 0x437e72
cmp dword [ebp - 0xc], esi
jne 0x437e72
call eax
jmp 0x437e72
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 0x63
lea edi, [ebp + eax*2 - 0x2e4]
call fcn.0042a64d
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.pecmd_bmp._lu._lu.tmp
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push 0x80
push 1
push esi
push 5
push 0x40000000
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 8]
call fcn.00404073
cmp dword [ebp - 8], esi
jne 0x437de5
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 0x10]
jns 0x437d81
lea ecx, [ebp - 8]
call fcn.00402abc
jmp 0x437d53
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
mov dword [ebp - 0x14], esi
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 8]
call fcn.00402abc
push 0x10
push esi
push esi
push esi
lea eax, [ebp - 0x2e4]
push eax
push esi
call dword [sym.imp.USER32.dll_LoadImageW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x437e48
lea eax, [ebp - 0x2e4]
push eax
call fcn.0043786b
mov edi, eax
cmp edi, esi
pop ecx
je 0x437e48
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edi
call dword [eax + 0xc]
cmp dword [ebp - 4], esi
jne 0x437e48
mov eax, dword [edi]
push edi
call dword [eax + 8]
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.00402abc
mov eax, dword [0x49b1b4]
cmp eax, esi
je 0x437e70
cmp dword [ebp - 0xc], esi
jne 0x437e70
call eax
mov esi, edi
pop ebx
push 0x49b604
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x43815c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 0x104
push edi
mov ecx, esi
call fcn.0042e20b
mov eax, dword [esi]
and word [eax], 0
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
push dword [esp + 0x18]
call edi
mov ebx, eax
test ebx, ebx
jle 0x4381a9
mov eax, dword [esi]
cmp word [eax], 0
jne 0x4381a9
lea eax, [ebx + 2]
push eax
mov ecx, esi
call fcn.0042e20b
inc ebx
push ebx
push dword [esi]
push dword [esp + 0x18]
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x43826b
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
cmp ax, 0x61
jb 0x438285
cmp ax, 0x7a
ja 0x438285
and eax, 0xffdf
push ebx
push esi
push 0x5c
pop ecx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
mov word [ebp - 0x1c], ax
mov word [ebp - 0x24], ax
push ebx
lea eax, [ebp - 0x2c]
push eax
mov word [ebp - 0x1a], 0x3a
mov word [ebp - 0x18], cx
mov word [ebp - 0x16], bx
mov word [ebp - 0x2c], cx
mov word [ebp - 0x2a], cx
mov word [ebp - 0x28], 0x2e
mov word [ebp - 0x26], cx
mov word [ebp - 0x22], 0x3a
mov word [ebp - 0x20], bx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x438324
push edi
push ebx
lea eax, [ebp - 0x30]
push eax
push 0xc
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push 0x2d1080
push esi
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
pop edi
je 0x438324
mov esi, dword [ebp - 0x3c]
cmp esi, 0xffffffff
je 0x438324
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push eax
push esi
mov dword [ebp - 8], ebx
call fcn.0042c955
cmp eax, ebx
pop ecx
pop ecx
jne 0x43832c
xor eax, eax
inc eax
jmp 0x4383c9
push ebx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov eax, dword [ebp - 0x14]
shr eax, 0xe
and al, 1
mov byte [ebp - 1], al
mov dword [ebp - 0xc], 1
mov esi, 0x208
push ebx
push esi
cmp al, bl
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov word [ebp - 0x248], bx
je 0x438390
call dword [sym.imp.SETUPAPI.dll_CM_Request_Device_EjectW]
jmp 0x438396
call dword [sym.imp.SETUPAPI.dll_CM_Query_And_Remove_SubTreeW]
cmp eax, ebx
jne 0x43839f
cmp dword [ebp - 0x10], ebx
je 0x4383bc
push 0xc8
mov ecx, 0x49aed0
call fcn.0040c4a3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jg 0x4383be
mov al, byte [ebp - 1]
jmp 0x43836d
mov bl, 1
neg bl
sbb ebx, ebx
and ebx, 0xfffffffe
inc ebx
inc ebx
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x438a4e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0x40
push edi
jae 0x438a61
xor eax, eax
jmp 0x438c17
push ebx
mov ebx, dword [ebp + 8]
cmp word [ebx], 0x5a4d
je 0x438a73
xor eax, eax
jmp 0x438c16
push esi
mov esi, dword [ebx + 0x3c]
lea eax, [esi + 0xf8]
cmp dword [ebp + 0xc], eax
jl 0x438c13
add esi, ebx
cmp dword [esi], 0x4550
jne 0x438c13
mov ax, word [esi + 0x16]
test ah, 0x20
jne 0x438c13
test al, 2
je 0x438c13
cmp word [esi + 0x14], 0xe0
jne 0x438c13
lea edi, [esi + 0xf8]
push edi
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0042d102
mov ecx, dword [ebp + 0x1c]
add esp, 0x10
test eax, eax
mov dword [ecx], eax
je 0x438c13
mov ecx, dword [esi + 0x54]
mov dword [ebp + 0xc], ecx
movzx ecx, word [esi + 6]
test ecx, ecx
jle 0x438afb
lea edx, [edi + 0x14]
mov esi, dword [edx]
test esi, esi
je 0x438af5
cmp esi, dword [ebp + 0xc]
jae 0x438af5
mov dword [ebp + 0xc], esi
add edx, 0x28
dec ecx
jne 0x438ae7
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
push 0x1000
push eax
push ecx
call esi
test eax, eax
mov edi, dword [ebp + 0x18]
mov dword [edi], eax
jne 0x438b36
mov eax, dword [ebp + 0x1c]
push 0x40
push 0x1000
push dword [eax]
push 0
call esi
test eax, eax
mov dword [edi], eax
je 0x438c13
push dword [ebp + 0xc]
push ebx
push dword [edi]
call fcn.004708c0
mov eax, dword [edi]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 0x14]
add eax, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
add eax, 0xf8
mov dword [edx], eax
mov ecx, dword [ecx]
mov ebx, dword [ecx + 0x38]
mov dword [ebp + 0xc], eax
mov eax, dword [ecx + 0x54]
lea eax, [eax + ebx - 1]
xor edx, edx
div ebx
add esp, 0xc
mov esi, eax
imul esi, ebx
add esi, dword [edi]
xor eax, eax
cmp word [ecx + 6], ax
mov dword [ebp - 4], eax
jbe 0x438c0e
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
add eax, ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x438b99
mov esi, dword [edi]
add esi, ecx
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x438bdd
mov eax, dword [eax + 0x14]
add eax, dword [ebp + 8]
push ecx
push eax
push esi
call fcn.004708c0
mov eax, dword [ebp + 0x14]
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
add eax, ebx
mov ecx, dword [eax + 0x10]
add esp, 0xc
cmp dword [eax + 8], ecx
jae 0x438bdd
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov dword [ebp - 8], eax
lea eax, [ecx + eax - 1]
xor edx, edx
div dword [ebp - 8]
imul eax, dword [ebp - 8]
jmp 0x438bf3
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x38]
mov eax, dword [eax + 8]
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
imul eax, ecx
add dword [ebp + 0xc], 0x28
add esi, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jl 0x438b89
xor eax, eax
inc eax
jmp 0x438c15
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret
Function at 0x438fe1
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x43900c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4390f8
push esi
lea eax, [ebp - 8]
push eax
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x43903c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x4390f7
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x439063
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x43902b
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push ebx
push 4
pop eax
push edi
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.0042e06b
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 2
push dword [ebp - 8]
call esi
mov esi, dword [ebp + 0x14]
push 0x4855be
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x10], esi
xor esi, esi
cmp dword [ebp - 4], edi
jbe 0x4390d9
movzx eax, byte [esi + ebx]
push eax
push str._02X
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add dword [ebp - 0x10], 2
add esp, 0xc
inc esi
cmp esi, dword [ebp - 4]
jb 0x4390b9
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [ebp - 0x18]
call fcn.00428a48
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret

Function at 0x439136
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x49b1d0], 0
jne 0x439144
call fcn.004390fb
mov ecx, dword [esp + 8]
push esi
or esi, 0xffffffff
test ecx, ecx
je 0x439173
mov eax, dword [esp + 8]
push edi
movzx edi, byte [eax]
mov edx, esi
and edx, 0xff
xor edx, edi
mov edi, dword [0x49b1d0]
shr esi, 8
xor esi, dword [edi + edx*4]
inc eax
dec ecx
jne 0x439155
pop edi
cmp dword [esp + 0x10], 0
not esi
je 0x43918f
push esi
push str._08X
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x43937f
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, dword [esp + 0x10]
mov edi, eax
lea eax, [edi + 2]
push eax
mov ecx, ebx
call fcn.0042e20b
mov eax, dword [ebx]
and word [eax], 0
inc edi
push edi
push dword [ebx]
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop edi
pop esi
pop ebx
ret 4
Function at 0x43bafb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.0043a4f0
mov esi, dword [eax]
push 0xffffffffffffffff
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.0043a4f0
push dword [eax]
push esi
push str._r_nRegSetDHCP__s__s__r_n
push 0x49aed0
call fcn.0040c0f5
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.00428a48
lea ecx, [ebp - 8]
call fcn.00428a48
mov esi, str.0.0.0.0
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push 4
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc]
push eax
push 4
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push str.EnableDHCP
push dword [ebx]
xor edi, edi
inc edi
mov dword [ebp - 0xc], edi
call esi
push 9
lea eax, [ebp - 0x18]
push eax
push 7
push 0
push str.IPAddress
push dword [ebx]
call esi
push 9
lea eax, [ebp - 0x18]
push eax
push 7
push 0
push str.SubnetMask
push dword [ebx]
call esi
push edi
push 0x484964
push 7
push 0
push str.DefaultGateway
push dword [ebx]
call esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43bbd8
cmp byte [eax], 0x2d
jne 0x43bbba
mov dword [ebp + 0xc], 0x4855be
cmp byte [eax], 0
je 0x43bbd8
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0xc]
push edi
push 0
push str.NameServer
push dword [ebx]
call esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x43c227
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
je 0x43c23a
or dword [ebp + 0x14], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042e1c4
cmp dword [ebp + 8], ebx
je 0x43c258
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [eax]
lea ecx, [ebp - 0x1c]
call fcn.0042e281
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push edi
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, dword [ebp - 0x20]
mov esi, eax
shl edi, 2
lea eax, [edi + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0042e06b
cmp esi, ebx
mov dword [ebp - 0x10], ebx
jne 0x43c36a
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
jle 0x43c36a
mov esi, dword [ebp - 0x18]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x24], edi
mov byte [esi], bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp byte [esi], 0x7b
jne 0x43c32d
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jl 0x43c2f6
cmp dword [ebp - 0x10], eax
jge 0x43c33a
inc dword [ebp - 0x10]
cmp dword [ebp + 8], ebx
je 0x43c32d
lea ecx, [ebp - 4]
call fcn.0042e1c4
push str.Name
push esi
lea esi, [ebp - 4]
call fcn.0043c182
pop ecx
pop ecx
push dword [ebp - 0x1c]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43c349
mov ecx, esi
call fcn.00428a48
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x43c2c8
jmp 0x43c36a
jne 0x43c36a
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push esi
call fcn.0042e0ff
jmp 0x43c36a
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
call fcn.0043a550
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 0x18]
call fcn.0042e0ff
lea ecx, [ebp - 4]
call fcn.00428a48
cmp dword [ebp - 8], ebx
pop edi
je 0x43c379
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp byte [eax], bl
je 0x43c399
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi]
cmp word [ecx], bx
jne 0x43c399
push str.Name
push eax
call fcn.0043c182
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
lea ecx, [ebp - 0x18]
call fcn.00428a48
lea ecx, [ebp - 0x1c]
call fcn.00428a48
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43fcc0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0x20]
call fcn.0042fe12
lea eax, [ebp + 8]
push eax
call fcn.00428a5b
pop ecx
push 5
lea ecx, [ebp - 0xc]
call fcn.0042e1e2
push 0x14
lea ecx, [ebp - 4]
call fcn.0042e1e2
push 2
lea eax, [ebp + 8]
push eax
xor edi, edi
push 0x48b09c
mov dword [ebp - 8], edi
call fcn.0042fc5f
add esp, 0xc
xor ebx, ebx
inc ebx
push ebx
movzx eax, al
push 0x2c
pop esi
mov dword [ebp - 0x10], eax
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0043c3b4
push edi
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.0043060a
mov eax, dword [ebp + 8]
add esp, 0xc
cmp word [eax], si
jne 0x43fd58
add dword [ebp + 8], 2
push ebx
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0043c3b4
push edi
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.0043060a
add esp, 0xc
mov eax, dword [ebp + 8]
cmp word [eax], si
jne 0x43fd80
add dword [ebp + 8], 2
push esi
lea eax, [ebp - 8]
push eax
push ebx
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0043c3b4
push eax
call fcn.00430857
add esp, 0xc
mov eax, dword [ebp - 0xc]
cmp word [eax], di
jne 0x43fd92
mov ebx, 0x80070057
jmp 0x43fe90
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 4]
jne 0x43fda4
cmp dword [ebp - 0x10], edi
jne 0x43fda4
cmp word [eax], di
je 0x43fd88
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + 0x214]
push eax
lea ecx, [ebp - 4]
call fcn.0042e20b
mov eax, dword [ebp - 4]
push eax
lea esi, [eax + esi*2 + 8]
mov dword [ebp - 0x14], edi
call fcn.0040dca1
push dword [ebp - 0xc]
mov edi, eax
call fcn.0040dca1
pop ecx
pop ecx
xor ecx, ecx
cmp dword [ebp - 0x10], ecx
mov dword [ebp + 8], eax
jne 0x43fdf2
cmp dword [ebp - 8], ecx
jne 0x43fdf2
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
jmp 0x43fe34
cmp dword [ebp - 8], 2
je 0x43fe3c
cmp dword [ebp - 0x10], ecx
jne 0x43fe3c
push edi
call fcn.0046fe88
push 0
mov esi, eax
push 0x49b190
neg esi
sbb esi, esi
push 0x48b08c
push str.CreateSymbolicLinkW
neg esi
call fcn.004299ca
mov eax, dword [0x49b190]
add esp, 0x14
test eax, eax
je 0x43fe90
push esi
push edi
push dword [ebp + 8]
call eax
test eax, eax
je 0x43fe88
xor ebx, ebx
jmp 0x43fe90
cmp word [edi], cx
jne 0x43fe4a
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x43fe80
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 8]
push eax
push 0x208
push edi
call fcn.0042e7bd
push esi
push dword [ebp + 8]
mov word [esi], 0x5c
mov word [esi + 2], 0x3f
mov word [esi + 4], 0x3f
mov word [esi + 6], 0x5c
call fcn.0042b832
add esp, 0x18
test eax, eax
je 0x43fe88
xor eax, eax
jmp 0x43fe8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea ecx, [ebp - 4]
call fcn.00428a48
lea ecx, [ebp - 0xc]
call fcn.00428a48
lea ecx, [ebp - 0x20]
call fcn.00428a48
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x43ff65
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi]
and word [eax], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43ffa8
push esi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x43ffa1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.0043a522
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
ret
Function at 0x440db7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov eax, esi
call fcn.0043826b
and word [ebp - 0xc], 0
and word [ebp - 2], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov word [ebp - 0x18], 0x20
mov word [ebp - 0x16], 0x2a
mov word [ebp - 0x14], 0x20
mov word [ebp - 0x12], si
mov word [ebp - 0x10], 0x3a
mov word [ebp - 0xe], 0x2c
mov word [ebp - 8], si
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0x5c
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x440e17
cmp ebx, 2
je 0x440e27
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x49aed0
call fcn.0043f2e5
pop ebx
leave
ret
Function at 0x44ee2b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
cmp ebx, esi
jne 0x44ef54
mov eax, dword [ebp - 0x10]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0042e1e2
cmp dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
jle 0x44ef4c
push edi
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
shl eax, 2
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], esi
push dword [ebp + 8]
mov word [edi], si
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x44ef3c
cmp word [edi], si
je 0x44ef3c
mov eax, dword [ebp + 0x10]
push dword [eax]
lea ecx, [ebp - 4]
call fcn.0043a4ba
push 0x484c48
lea ecx, [ebp - 4]
call fcn.0042e232
push edi
lea ecx, [ebp - 4]
call fcn.0042e232
push esi
push dword [ebp + 0xc]
push esi
push esi
push 4
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
lea eax, [ebp - 8]
push eax
movzx eax, word [0x49ab68]
or eax, 0xf003f
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x44ef34
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0044ee2b
add esp, 0xc
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x44ef34
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
call fcn.00428a48
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x44ee82
pop edi
lea ecx, [ebp - 0x18]
call fcn.00428a48
pop esi
mov eax, ebx
pop ebx
leave
ret